xmrig | 05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
Size

1.2MB
MD5

9d6ff2a47ab069b35f307a7cd0a405bb
SHA1

fd37605c3013b28cc81e894bc36a84131b6b9c66
SHA256

05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a
SHA512

390d82260b19b58198a8188cfb2095572f2d58a1ea3ce91025b365b106ed399bce861e81bc2ef4776e442e325cac8daf0d389d8879fa7c3809c2bd6f3cff849c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nesEp/7:GezaTF8FcNkNdfE0pZ9ozttwIRxA1sEh

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012261-2.dat	xmrig
behavioral1/files/0x0008000000016c81-8.dat	xmrig
behavioral1/files/0x0008000000016bfc-6.dat	xmrig
behavioral1/files/0x0007000000016cf8-18.dat	xmrig
behavioral1/files/0x0007000000016d11-23.dat	xmrig
behavioral1/files/0x0005000000019494-58.dat	xmrig
behavioral1/files/0x00050000000194da-78.dat	xmrig
behavioral1/files/0x00050000000194f6-98.dat	xmrig
behavioral1/files/0x0005000000019503-108.dat	xmrig
behavioral1/files/0x000500000001957c-121.dat	xmrig
behavioral1/files/0x000500000001961b-133.dat	xmrig
behavioral1/files/0x0005000000019aea-158.dat	xmrig
behavioral1/files/0x00050000000197c1-153.dat	xmrig
behavioral1/files/0x0005000000019624-144.dat	xmrig
behavioral1/files/0x0005000000019625-148.dat	xmrig
behavioral1/files/0x000500000001961f-138.dat	xmrig
behavioral1/files/0x0005000000019589-128.dat	xmrig
behavioral1/files/0x0005000000019515-113.dat	xmrig
behavioral1/files/0x000500000001953a-118.dat	xmrig
behavioral1/files/0x0005000000019501-104.dat	xmrig
behavioral1/files/0x00050000000194f2-93.dat	xmrig
behavioral1/files/0x00050000000194ea-88.dat	xmrig
behavioral1/files/0x00050000000194e2-83.dat	xmrig
behavioral1/files/0x00050000000194d4-73.dat	xmrig
behavioral1/files/0x00050000000194b4-68.dat	xmrig
behavioral1/files/0x00050000000194a7-63.dat	xmrig
behavioral1/files/0x0005000000019408-53.dat	xmrig
behavioral1/files/0x00050000000193fa-48.dat	xmrig
behavioral1/files/0x00050000000193f8-44.dat	xmrig
behavioral1/files/0x0008000000016d4a-38.dat	xmrig
behavioral1/files/0x0009000000016d46-34.dat	xmrig
behavioral1/files/0x0007000000016d33-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	sjFkTNj.exe
1824	yBYdlIO.exe
2092	xTbcsrS.exe
2312	zNlrMSo.exe
2096	zMewUPs.exe
2424	mtrplGk.exe
2696	RvCzUoF.exe
2788	NGrAtTY.exe
2816	mQISVRa.exe
2712	KFlndpz.exe
2880	PauhqEF.exe
2840	FGxHetx.exe
2612	hBYCOEy.exe
2828	dCxjvAZ.exe
1836	aCNLYVc.exe
2620	cIhjbyC.exe
3012	gIRUHKT.exe
2476	xUUMotP.exe
1860	BMXJmQT.exe
1664	buoGfno.exe
1520	pXIeNUd.exe
1484	YvKDWLl.exe
2688	MgtIbTL.exe
1984	RdjzihZ.exe
1060	rtTqLQT.exe
2472	TpWdEvW.exe
1772	sEjXcwe.exe
2256	qqXuihi.exe
2192	MdUuoTP.exe
2084	KxuonCX.exe
784	UBUUvTn.exe
2252	YBrzsvX.exe
1596	hwzMUUR.exe
1104	JGxXNiB.exe
624	ZQwpJMX.exe
2956	zmyOVZw.exe
2948	BAqqxkl.exe
1816	TDqRbrL.exe
1356	YRSIQPS.exe
496	PErKjGv.exe
2972	FEwntek.exe
1376	gVHXEWn.exe
1780	TnqsXHX.exe
2980	jVTYclE.exe
1724	hqeFBSN.exe
748	kFqqgYg.exe
564	ahsjtrE.exe
2968	LXCouMm.exe
1428	ceSorBk.exe
2356	vlZjihX.exe
2184	lGFNqpu.exe
3060	HiZrQsN.exe
2124	OFfZThi.exe
2112	dyQDjvc.exe
888	QuHHWYV.exe
1168	OqfmqWt.exe
2024	sLUIACE.exe
1620	idGOzbW.exe
1608	Niyjuxz.exe
2668	uTicllI.exe
2228	HKuxdvn.exe
2772	JfeOjxG.exe
1792	qyyNiaf.exe
2824	iqzOcZb.exe

Loads dropped DLL 64 IoCs

pid	Process
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vlWgbDf.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\ReVVwaw.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\CrgXQFC.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\gyoHkcb.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\oBqEXiI.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\nZyYYip.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\ZQwpJMX.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\RlPfHcN.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\YteBpbK.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\icALccC.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\RiKtnEg.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\wqKdVsq.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\eesNZAi.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\gmdOVoo.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\EvzNoOA.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\vxEjpsC.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\TDqRbrL.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\HTAZXNq.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\sRmgidI.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\PiUoSDq.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\wmCdWxR.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\IlnyXeo.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\nGzqVPF.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\kTCmgkw.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\TyGUdwf.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\HhuCpxO.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\awjrHVN.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\dQNRitu.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\fsCeTTp.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\XutXtbj.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\JSJhJop.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\nyCgRfV.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\zFeKciU.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\kBZyvwl.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\lPcGutY.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\WaYdRzb.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\TOdltJd.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\lZmJDnI.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\ctDgTQq.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\oIKYZCi.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\haMWmXr.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\rZPDTky.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\eWWRTFS.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\jNFAVWz.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\QtMIfiC.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\wLQxvmp.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\BdEQDUv.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\wfEgfbo.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\OFPYKDk.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\pfMiZnc.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\UhszwUy.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\ksGpUbN.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\kqpeTzi.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\IHpavSr.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\gJfeKYY.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\ZXEWYQr.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\GNPrnnp.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\aHgSFGl.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\oGkLkOk.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\RtAkdUM.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\jDNAWDw.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\xutmazj.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\yEiPOJh.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
File created	C:\Windows\System\KHRcCGC.exe	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2560	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	31
PID 2076 wrote to memory of 2560	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	31
PID 2076 wrote to memory of 2560	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	31
PID 2076 wrote to memory of 1824	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	32
PID 2076 wrote to memory of 1824	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	32
PID 2076 wrote to memory of 1824	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	32
PID 2076 wrote to memory of 2092	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	33
PID 2076 wrote to memory of 2092	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	33
PID 2076 wrote to memory of 2092	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	33
PID 2076 wrote to memory of 2312	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	34
PID 2076 wrote to memory of 2312	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	34
PID 2076 wrote to memory of 2312	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	34
PID 2076 wrote to memory of 2096	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	35
PID 2076 wrote to memory of 2096	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	35
PID 2076 wrote to memory of 2096	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	35
PID 2076 wrote to memory of 2424	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	36
PID 2076 wrote to memory of 2424	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	36
PID 2076 wrote to memory of 2424	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	36
PID 2076 wrote to memory of 2696	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	37
PID 2076 wrote to memory of 2696	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	37
PID 2076 wrote to memory of 2696	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	37
PID 2076 wrote to memory of 2788	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	38
PID 2076 wrote to memory of 2788	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	38
PID 2076 wrote to memory of 2788	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	38
PID 2076 wrote to memory of 2816	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	39
PID 2076 wrote to memory of 2816	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	39
PID 2076 wrote to memory of 2816	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	39
PID 2076 wrote to memory of 2712	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	40
PID 2076 wrote to memory of 2712	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	40
PID 2076 wrote to memory of 2712	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	40
PID 2076 wrote to memory of 2880	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	41
PID 2076 wrote to memory of 2880	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	41
PID 2076 wrote to memory of 2880	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	41
PID 2076 wrote to memory of 2840	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	42
PID 2076 wrote to memory of 2840	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	42
PID 2076 wrote to memory of 2840	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	42
PID 2076 wrote to memory of 2612	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	43
PID 2076 wrote to memory of 2612	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	43
PID 2076 wrote to memory of 2612	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	43
PID 2076 wrote to memory of 2828	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	44
PID 2076 wrote to memory of 2828	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	44
PID 2076 wrote to memory of 2828	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	44
PID 2076 wrote to memory of 1836	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	45
PID 2076 wrote to memory of 1836	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	45
PID 2076 wrote to memory of 1836	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	45
PID 2076 wrote to memory of 2620	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	46
PID 2076 wrote to memory of 2620	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	46
PID 2076 wrote to memory of 2620	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	46
PID 2076 wrote to memory of 3012	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	47
PID 2076 wrote to memory of 3012	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	47
PID 2076 wrote to memory of 3012	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	47
PID 2076 wrote to memory of 2476	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	48
PID 2076 wrote to memory of 2476	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	48
PID 2076 wrote to memory of 2476	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	48
PID 2076 wrote to memory of 1860	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	49
PID 2076 wrote to memory of 1860	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	49
PID 2076 wrote to memory of 1860	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	49
PID 2076 wrote to memory of 1664	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	50
PID 2076 wrote to memory of 1664	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	50
PID 2076 wrote to memory of 1664	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	50
PID 2076 wrote to memory of 1520	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	51
PID 2076 wrote to memory of 1520	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	51
PID 2076 wrote to memory of 1520	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	51
PID 2076 wrote to memory of 1484	2076	05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe	52

C:\Users\Admin\AppData\Local\Temp\05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe
"C:\Users\Admin\AppData\Local\Temp\05ab078920b52f34904b4dc1b6b384bf7b447f3b963412b49ddaa6b39c18762a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\System\sjFkTNj.exe
  C:\Windows\System\sjFkTNj.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\yBYdlIO.exe
  C:\Windows\System\yBYdlIO.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\xTbcsrS.exe
  C:\Windows\System\xTbcsrS.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\zNlrMSo.exe
  C:\Windows\System\zNlrMSo.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\zMewUPs.exe
  C:\Windows\System\zMewUPs.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\mtrplGk.exe
  C:\Windows\System\mtrplGk.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\RvCzUoF.exe
  C:\Windows\System\RvCzUoF.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\NGrAtTY.exe
  C:\Windows\System\NGrAtTY.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\mQISVRa.exe
  C:\Windows\System\mQISVRa.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\KFlndpz.exe
  C:\Windows\System\KFlndpz.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\PauhqEF.exe
  C:\Windows\System\PauhqEF.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\FGxHetx.exe
  C:\Windows\System\FGxHetx.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\hBYCOEy.exe
  C:\Windows\System\hBYCOEy.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dCxjvAZ.exe
  C:\Windows\System\dCxjvAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\aCNLYVc.exe
  C:\Windows\System\aCNLYVc.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\cIhjbyC.exe
  C:\Windows\System\cIhjbyC.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\gIRUHKT.exe
  C:\Windows\System\gIRUHKT.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\xUUMotP.exe
  C:\Windows\System\xUUMotP.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\BMXJmQT.exe
  C:\Windows\System\BMXJmQT.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\buoGfno.exe
  C:\Windows\System\buoGfno.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\pXIeNUd.exe
  C:\Windows\System\pXIeNUd.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\YvKDWLl.exe
  C:\Windows\System\YvKDWLl.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\MgtIbTL.exe
  C:\Windows\System\MgtIbTL.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\RdjzihZ.exe
  C:\Windows\System\RdjzihZ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\rtTqLQT.exe
  C:\Windows\System\rtTqLQT.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\TpWdEvW.exe
  C:\Windows\System\TpWdEvW.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\sEjXcwe.exe
  C:\Windows\System\sEjXcwe.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\qqXuihi.exe
  C:\Windows\System\qqXuihi.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\MdUuoTP.exe
  C:\Windows\System\MdUuoTP.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\KxuonCX.exe
  C:\Windows\System\KxuonCX.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\UBUUvTn.exe
  C:\Windows\System\UBUUvTn.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\YBrzsvX.exe
  C:\Windows\System\YBrzsvX.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\hwzMUUR.exe
  C:\Windows\System\hwzMUUR.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\JGxXNiB.exe
  C:\Windows\System\JGxXNiB.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\ZQwpJMX.exe
  C:\Windows\System\ZQwpJMX.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\zmyOVZw.exe
  C:\Windows\System\zmyOVZw.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\BAqqxkl.exe
  C:\Windows\System\BAqqxkl.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\TDqRbrL.exe
  C:\Windows\System\TDqRbrL.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\YRSIQPS.exe
  C:\Windows\System\YRSIQPS.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\PErKjGv.exe
  C:\Windows\System\PErKjGv.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\FEwntek.exe
  C:\Windows\System\FEwntek.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\gVHXEWn.exe
  C:\Windows\System\gVHXEWn.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\TnqsXHX.exe
  C:\Windows\System\TnqsXHX.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\jVTYclE.exe
  C:\Windows\System\jVTYclE.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\hqeFBSN.exe
  C:\Windows\System\hqeFBSN.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\kFqqgYg.exe
  C:\Windows\System\kFqqgYg.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ahsjtrE.exe
  C:\Windows\System\ahsjtrE.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\LXCouMm.exe
  C:\Windows\System\LXCouMm.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ceSorBk.exe
  C:\Windows\System\ceSorBk.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\vlZjihX.exe
  C:\Windows\System\vlZjihX.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\lGFNqpu.exe
  C:\Windows\System\lGFNqpu.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\HiZrQsN.exe
  C:\Windows\System\HiZrQsN.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\OFfZThi.exe
  C:\Windows\System\OFfZThi.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\dyQDjvc.exe
  C:\Windows\System\dyQDjvc.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\QuHHWYV.exe
  C:\Windows\System\QuHHWYV.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\OqfmqWt.exe
  C:\Windows\System\OqfmqWt.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\sLUIACE.exe
  C:\Windows\System\sLUIACE.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\idGOzbW.exe
  C:\Windows\System\idGOzbW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\Niyjuxz.exe
  C:\Windows\System\Niyjuxz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\uTicllI.exe
  C:\Windows\System\uTicllI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\HKuxdvn.exe
  C:\Windows\System\HKuxdvn.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\JfeOjxG.exe
  C:\Windows\System\JfeOjxG.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\qyyNiaf.exe
  C:\Windows\System\qyyNiaf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\iqzOcZb.exe
  C:\Windows\System\iqzOcZb.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\qgjFMEO.exe
  C:\Windows\System\qgjFMEO.exe
  2⤵
  PID:2460
- C:\Windows\System\nYvvCxT.exe
  C:\Windows\System\nYvvCxT.exe
  2⤵
  PID:2624
- C:\Windows\System\YTVpvXP.exe
  C:\Windows\System\YTVpvXP.exe
  2⤵
  PID:2752
- C:\Windows\System\nwWLqZJ.exe
  C:\Windows\System\nwWLqZJ.exe
  2⤵
  PID:2584
- C:\Windows\System\ZZtQuhv.exe
  C:\Windows\System\ZZtQuhv.exe
  2⤵
  PID:2708
- C:\Windows\System\hhTmXEy.exe
  C:\Windows\System\hhTmXEy.exe
  2⤵
  PID:1916
- C:\Windows\System\PWCelRC.exe
  C:\Windows\System\PWCelRC.exe
  2⤵
  PID:676
- C:\Windows\System\mVuooBw.exe
  C:\Windows\System\mVuooBw.exe
  2⤵
  PID:1116
- C:\Windows\System\cBLbROX.exe
  C:\Windows\System\cBLbROX.exe
  2⤵
  PID:1932
- C:\Windows\System\SOayFWb.exe
  C:\Windows\System\SOayFWb.exe
  2⤵
  PID:2000
- C:\Windows\System\gkCpUWS.exe
  C:\Windows\System\gkCpUWS.exe
  2⤵
  PID:1336
- C:\Windows\System\nDKpvUM.exe
  C:\Windows\System\nDKpvUM.exe
  2⤵
  PID:2204
- C:\Windows\System\kRBDxqb.exe
  C:\Windows\System\kRBDxqb.exe
  2⤵
  PID:820
- C:\Windows\System\QhZoUWM.exe
  C:\Windows\System\QhZoUWM.exe
  2⤵
  PID:1256
- C:\Windows\System\vTcYCtK.exe
  C:\Windows\System\vTcYCtK.exe
  2⤵
  PID:2196
- C:\Windows\System\agooKQL.exe
  C:\Windows\System\agooKQL.exe
  2⤵
  PID:1872
- C:\Windows\System\yCmwTLU.exe
  C:\Windows\System\yCmwTLU.exe
  2⤵
  PID:448
- C:\Windows\System\hZwZHlU.exe
  C:\Windows\System\hZwZHlU.exe
  2⤵
  PID:2568
- C:\Windows\System\ZEccBly.exe
  C:\Windows\System\ZEccBly.exe
  2⤵
  PID:1532
- C:\Windows\System\RVhgKbV.exe
  C:\Windows\System\RVhgKbV.exe
  2⤵
  PID:1212
- C:\Windows\System\BdEQDUv.exe
  C:\Windows\System\BdEQDUv.exe
  2⤵
  PID:1648
- C:\Windows\System\kcRbUDV.exe
  C:\Windows\System\kcRbUDV.exe
  2⤵
  PID:1548
- C:\Windows\System\QJdGQHz.exe
  C:\Windows\System\QJdGQHz.exe
  2⤵
  PID:2984
- C:\Windows\System\tJcTKyI.exe
  C:\Windows\System\tJcTKyI.exe
  2⤵
  PID:2428
- C:\Windows\System\bIeTXEX.exe
  C:\Windows\System\bIeTXEX.exe
  2⤵
  PID:3056
- C:\Windows\System\vlWgbDf.exe
  C:\Windows\System\vlWgbDf.exe
  2⤵
  PID:2300
- C:\Windows\System\pfKrZJY.exe
  C:\Windows\System\pfKrZJY.exe
  2⤵
  PID:1828
- C:\Windows\System\vuJdLnD.exe
  C:\Windows\System\vuJdLnD.exe
  2⤵
  PID:708
- C:\Windows\System\XLaOEQL.exe
  C:\Windows\System\XLaOEQL.exe
  2⤵
  PID:2992
- C:\Windows\System\vWPhwMd.exe
  C:\Windows\System\vWPhwMd.exe
  2⤵
  PID:2920
- C:\Windows\System\hDHLAeH.exe
  C:\Windows\System\hDHLAeH.exe
  2⤵
  PID:1580
- C:\Windows\System\AOjWILy.exe
  C:\Windows\System\AOjWILy.exe
  2⤵
  PID:1848
- C:\Windows\System\SKcBmVh.exe
  C:\Windows\System\SKcBmVh.exe
  2⤵
  PID:2304
- C:\Windows\System\zAVpsuY.exe
  C:\Windows\System\zAVpsuY.exe
  2⤵
  PID:1840
- C:\Windows\System\oqGwari.exe
  C:\Windows\System\oqGwari.exe
  2⤵
  PID:2744
- C:\Windows\System\ynzqcHG.exe
  C:\Windows\System\ynzqcHG.exe
  2⤵
  PID:2220
- C:\Windows\System\tOVsKHb.exe
  C:\Windows\System\tOVsKHb.exe
  2⤵
  PID:2804
- C:\Windows\System\uoyGizG.exe
  C:\Windows\System\uoyGizG.exe
  2⤵
  PID:2644
- C:\Windows\System\RDkQjAS.exe
  C:\Windows\System\RDkQjAS.exe
  2⤵
  PID:2436
- C:\Windows\System\RlPfHcN.exe
  C:\Windows\System\RlPfHcN.exe
  2⤵
  PID:2884
- C:\Windows\System\NDlGoLg.exe
  C:\Windows\System\NDlGoLg.exe
  2⤵
  PID:1976
- C:\Windows\System\fWHkspX.exe
  C:\Windows\System\fWHkspX.exe
  2⤵
  PID:2416
- C:\Windows\System\bmFvMRf.exe
  C:\Windows\System\bmFvMRf.exe
  2⤵
  PID:552
- C:\Windows\System\bBKQYQu.exe
  C:\Windows\System\bBKQYQu.exe
  2⤵
  PID:1492
- C:\Windows\System\NxkrxUg.exe
  C:\Windows\System\NxkrxUg.exe
  2⤵
  PID:844
- C:\Windows\System\EuItfzC.exe
  C:\Windows\System\EuItfzC.exe
  2⤵
  PID:1864
- C:\Windows\System\KjcQsLf.exe
  C:\Windows\System\KjcQsLf.exe
  2⤵
  PID:2176
- C:\Windows\System\znIvnzL.exe
  C:\Windows\System\znIvnzL.exe
  2⤵
  PID:1744
- C:\Windows\System\iNaYExC.exe
  C:\Windows\System\iNaYExC.exe
  2⤵
  PID:2180
- C:\Windows\System\gIOtDcm.exe
  C:\Windows\System\gIOtDcm.exe
  2⤵
  PID:2692
- C:\Windows\System\dALhTkg.exe
  C:\Windows\System\dALhTkg.exe
  2⤵
  PID:1012
- C:\Windows\System\FrGsomr.exe
  C:\Windows\System\FrGsomr.exe
  2⤵
  PID:2408
- C:\Windows\System\UkmGJSA.exe
  C:\Windows\System\UkmGJSA.exe
  2⤵
  PID:2736
- C:\Windows\System\ZtLvBaA.exe
  C:\Windows\System\ZtLvBaA.exe
  2⤵
  PID:2440
- C:\Windows\System\irtsWEU.exe
  C:\Windows\System\irtsWEU.exe
  2⤵
  PID:1516
- C:\Windows\System\LGpPrTH.exe
  C:\Windows\System\LGpPrTH.exe
  2⤵
  PID:2316
- C:\Windows\System\tlNTICD.exe
  C:\Windows\System\tlNTICD.exe
  2⤵
  PID:2740
- C:\Windows\System\FmJICBX.exe
  C:\Windows\System\FmJICBX.exe
  2⤵
  PID:1616
- C:\Windows\System\xNTeikl.exe
  C:\Windows\System\xNTeikl.exe
  2⤵
  PID:2148
- C:\Windows\System\YeCERIc.exe
  C:\Windows\System\YeCERIc.exe
  2⤵
  PID:1568
- C:\Windows\System\ifVSjop.exe
  C:\Windows\System\ifVSjop.exe
  2⤵
  PID:2928
- C:\Windows\System\jsEozvX.exe
  C:\Windows\System\jsEozvX.exe
  2⤵
  PID:1240
- C:\Windows\System\DxhQQzD.exe
  C:\Windows\System\DxhQQzD.exe
  2⤵
  PID:2672
- C:\Windows\System\sjGzvyf.exe
  C:\Windows\System\sjGzvyf.exe
  2⤵
  PID:2364
- C:\Windows\System\LIgCisc.exe
  C:\Windows\System\LIgCisc.exe
  2⤵
  PID:2784
- C:\Windows\System\dYzCrVv.exe
  C:\Windows\System\dYzCrVv.exe
  2⤵
  PID:1272
- C:\Windows\System\rTBpqdx.exe
  C:\Windows\System\rTBpqdx.exe
  2⤵
  PID:616
- C:\Windows\System\RHuPNhk.exe
  C:\Windows\System\RHuPNhk.exe
  2⤵
  PID:468
- C:\Windows\System\ErndSiq.exe
  C:\Windows\System\ErndSiq.exe
  2⤵
  PID:2320
- C:\Windows\System\LErArjW.exe
  C:\Windows\System\LErArjW.exe
  2⤵
  PID:1540
- C:\Windows\System\RECgCvS.exe
  C:\Windows\System\RECgCvS.exe
  2⤵
  PID:2516
- C:\Windows\System\EMPGhXz.exe
  C:\Windows\System\EMPGhXz.exe
  2⤵
  PID:2716
- C:\Windows\System\uYaMnDL.exe
  C:\Windows\System\uYaMnDL.exe
  2⤵
  PID:2164
- C:\Windows\System\vkpOgWs.exe
  C:\Windows\System\vkpOgWs.exe
  2⤵
  PID:1924
- C:\Windows\System\DMfWNCf.exe
  C:\Windows\System\DMfWNCf.exe
  2⤵
  PID:3028
- C:\Windows\System\ueLrhoB.exe
  C:\Windows\System\ueLrhoB.exe
  2⤵
  PID:1812
- C:\Windows\System\laTdnMw.exe
  C:\Windows\System\laTdnMw.exe
  2⤵
  PID:2912
- C:\Windows\System\tuScOqN.exe
  C:\Windows\System\tuScOqN.exe
  2⤵
  PID:968
- C:\Windows\System\fafEBHK.exe
  C:\Windows\System\fafEBHK.exe
  2⤵
  PID:2660
- C:\Windows\System\cZSuvVQ.exe
  C:\Windows\System\cZSuvVQ.exe
  2⤵
  PID:896
- C:\Windows\System\ovffZJy.exe
  C:\Windows\System\ovffZJy.exe
  2⤵
  PID:2832
- C:\Windows\System\qaKYBzh.exe
  C:\Windows\System\qaKYBzh.exe
  2⤵
  PID:1488
- C:\Windows\System\OUsVgYu.exe
  C:\Windows\System\OUsVgYu.exe
  2⤵
  PID:2616
- C:\Windows\System\ufPZenr.exe
  C:\Windows\System\ufPZenr.exe
  2⤵
  PID:2132
- C:\Windows\System\uZOzoqw.exe
  C:\Windows\System\uZOzoqw.exe
  2⤵
  PID:2900
- C:\Windows\System\LpIMXkG.exe
  C:\Windows\System\LpIMXkG.exe
  2⤵
  PID:2156
- C:\Windows\System\kqhoCoB.exe
  C:\Windows\System\kqhoCoB.exe
  2⤵
  PID:2284
- C:\Windows\System\irGBFyM.exe
  C:\Windows\System\irGBFyM.exe
  2⤵
  PID:2484
- C:\Windows\System\mCpslRm.exe
  C:\Windows\System\mCpslRm.exe
  2⤵
  PID:288
- C:\Windows\System\NSoRlTp.exe
  C:\Windows\System\NSoRlTp.exe
  2⤵
  PID:1712
- C:\Windows\System\glSYJlO.exe
  C:\Windows\System\glSYJlO.exe
  2⤵
  PID:1072
- C:\Windows\System\bYaqdaD.exe
  C:\Windows\System\bYaqdaD.exe
  2⤵
  PID:1588
- C:\Windows\System\LGSDIwM.exe
  C:\Windows\System\LGSDIwM.exe
  2⤵
  PID:2336
- C:\Windows\System\iFvRrjM.exe
  C:\Windows\System\iFvRrjM.exe
  2⤵
  PID:916
- C:\Windows\System\ectTypE.exe
  C:\Windows\System\ectTypE.exe
  2⤵
  PID:2728
- C:\Windows\System\xsByWhe.exe
  C:\Windows\System\xsByWhe.exe
  2⤵
  PID:1496
- C:\Windows\System\bretxLr.exe
  C:\Windows\System\bretxLr.exe
  2⤵
  PID:1008
- C:\Windows\System\NiKSKVW.exe
  C:\Windows\System\NiKSKVW.exe
  2⤵
  PID:1804
- C:\Windows\System\EFrczda.exe
  C:\Windows\System\EFrczda.exe
  2⤵
  PID:572
- C:\Windows\System\MffOwVb.exe
  C:\Windows\System\MffOwVb.exe
  2⤵
  PID:3080
- C:\Windows\System\HBBoaxa.exe
  C:\Windows\System\HBBoaxa.exe
  2⤵
  PID:3096
- C:\Windows\System\AguHWcr.exe
  C:\Windows\System\AguHWcr.exe
  2⤵
  PID:3116
- C:\Windows\System\sgWofuZ.exe
  C:\Windows\System\sgWofuZ.exe
  2⤵
  PID:3132
- C:\Windows\System\nmhuexW.exe
  C:\Windows\System\nmhuexW.exe
  2⤵
  PID:3148
- C:\Windows\System\TauVMVn.exe
  C:\Windows\System\TauVMVn.exe
  2⤵
  PID:3164
- C:\Windows\System\LvBTLWo.exe
  C:\Windows\System\LvBTLWo.exe
  2⤵
  PID:3184
- C:\Windows\System\QSGXJOQ.exe
  C:\Windows\System\QSGXJOQ.exe
  2⤵
  PID:3200
- C:\Windows\System\XIhDowr.exe
  C:\Windows\System\XIhDowr.exe
  2⤵
  PID:3220
- C:\Windows\System\GQMShRX.exe
  C:\Windows\System\GQMShRX.exe
  2⤵
  PID:3236
- C:\Windows\System\fTSXQHG.exe
  C:\Windows\System\fTSXQHG.exe
  2⤵
  PID:3252
- C:\Windows\System\ZPvILqY.exe
  C:\Windows\System\ZPvILqY.exe
  2⤵
  PID:3268
- C:\Windows\System\VpgQxis.exe
  C:\Windows\System\VpgQxis.exe
  2⤵
  PID:3284
- C:\Windows\System\QozDale.exe
  C:\Windows\System\QozDale.exe
  2⤵
  PID:3304
- C:\Windows\System\WwlhrWJ.exe
  C:\Windows\System\WwlhrWJ.exe
  2⤵
  PID:3320
- C:\Windows\System\KnHCTHx.exe
  C:\Windows\System\KnHCTHx.exe
  2⤵
  PID:3336
- C:\Windows\System\eesNZAi.exe
  C:\Windows\System\eesNZAi.exe
  2⤵
  PID:3360
- C:\Windows\System\EsksCiZ.exe
  C:\Windows\System\EsksCiZ.exe
  2⤵
  PID:3380
- C:\Windows\System\YDiTtha.exe
  C:\Windows\System\YDiTtha.exe
  2⤵
  PID:3396
- C:\Windows\System\jSDsSJB.exe
  C:\Windows\System\jSDsSJB.exe
  2⤵
  PID:3416
- C:\Windows\System\ReVVwaw.exe
  C:\Windows\System\ReVVwaw.exe
  2⤵
  PID:3472
- C:\Windows\System\eOqqAzo.exe
  C:\Windows\System\eOqqAzo.exe
  2⤵
  PID:3504
- C:\Windows\System\yHuPTxZ.exe
  C:\Windows\System\yHuPTxZ.exe
  2⤵
  PID:3540
- C:\Windows\System\OcaCRUv.exe
  C:\Windows\System\OcaCRUv.exe
  2⤵
  PID:3556
- C:\Windows\System\CzdARyX.exe
  C:\Windows\System\CzdARyX.exe
  2⤵
  PID:3572
- C:\Windows\System\XUGhAPQ.exe
  C:\Windows\System\XUGhAPQ.exe
  2⤵
  PID:3592
- C:\Windows\System\YzHzwWy.exe
  C:\Windows\System\YzHzwWy.exe
  2⤵
  PID:3608
- C:\Windows\System\kTLTTxa.exe
  C:\Windows\System\kTLTTxa.exe
  2⤵
  PID:3628
- C:\Windows\System\QdvKdKP.exe
  C:\Windows\System\QdvKdKP.exe
  2⤵
  PID:3644
- C:\Windows\System\fCTDRQj.exe
  C:\Windows\System\fCTDRQj.exe
  2⤵
  PID:3664
- C:\Windows\System\wMasLTk.exe
  C:\Windows\System\wMasLTk.exe
  2⤵
  PID:3684
- C:\Windows\System\csjxAuX.exe
  C:\Windows\System\csjxAuX.exe
  2⤵
  PID:3704
- C:\Windows\System\DILjNOm.exe
  C:\Windows\System\DILjNOm.exe
  2⤵
  PID:3740
- C:\Windows\System\jezsqRB.exe
  C:\Windows\System\jezsqRB.exe
  2⤵
  PID:3760
- C:\Windows\System\lJTREaQ.exe
  C:\Windows\System\lJTREaQ.exe
  2⤵
  PID:3776
- C:\Windows\System\eQHeFFf.exe
  C:\Windows\System\eQHeFFf.exe
  2⤵
  PID:3800
- C:\Windows\System\XAWOhnX.exe
  C:\Windows\System\XAWOhnX.exe
  2⤵
  PID:3816
- C:\Windows\System\eNqxNul.exe
  C:\Windows\System\eNqxNul.exe
  2⤵
  PID:3836
- C:\Windows\System\GCKTrsc.exe
  C:\Windows\System\GCKTrsc.exe
  2⤵
  PID:3852
- C:\Windows\System\iAzlBAg.exe
  C:\Windows\System\iAzlBAg.exe
  2⤵
  PID:3872
- C:\Windows\System\jkccpQE.exe
  C:\Windows\System\jkccpQE.exe
  2⤵
  PID:3888
- C:\Windows\System\PTAVHbR.exe
  C:\Windows\System\PTAVHbR.exe
  2⤵
  PID:3948
- C:\Windows\System\CiCwBux.exe
  C:\Windows\System\CiCwBux.exe
  2⤵
  PID:3964
- C:\Windows\System\iHjgtpI.exe
  C:\Windows\System\iHjgtpI.exe
  2⤵
  PID:3980
- C:\Windows\System\lOVVgFc.exe
  C:\Windows\System\lOVVgFc.exe
  2⤵
  PID:3996
- C:\Windows\System\hvEbvoj.exe
  C:\Windows\System\hvEbvoj.exe
  2⤵
  PID:4016
- C:\Windows\System\NVKNvIC.exe
  C:\Windows\System\NVKNvIC.exe
  2⤵
  PID:4032
- C:\Windows\System\sNVjldW.exe
  C:\Windows\System\sNVjldW.exe
  2⤵
  PID:4052
- C:\Windows\System\TYoVsIs.exe
  C:\Windows\System\TYoVsIs.exe
  2⤵
  PID:4068
- C:\Windows\System\YteBpbK.exe
  C:\Windows\System\YteBpbK.exe
  2⤵
  PID:4088
- C:\Windows\System\uHwfbZx.exe
  C:\Windows\System\uHwfbZx.exe
  2⤵
  PID:1056
- C:\Windows\System\OwJWNle.exe
  C:\Windows\System\OwJWNle.exe
  2⤵
  PID:1656
- C:\Windows\System\FBLMAtv.exe
  C:\Windows\System\FBLMAtv.exe
  2⤵
  PID:3128
- C:\Windows\System\oWpwgii.exe
  C:\Windows\System\oWpwgii.exe
  2⤵
  PID:1408
- C:\Windows\System\YTbDWNz.exe
  C:\Windows\System\YTbDWNz.exe
  2⤵
  PID:3228
- C:\Windows\System\flkEjzQ.exe
  C:\Windows\System\flkEjzQ.exe
  2⤵
  PID:3292
- C:\Windows\System\hRHwVlx.exe
  C:\Windows\System\hRHwVlx.exe
  2⤵
  PID:3368
- C:\Windows\System\UlJbmWW.exe
  C:\Windows\System\UlJbmWW.exe
  2⤵
  PID:3408
- C:\Windows\System\AQDJCGG.exe
  C:\Windows\System\AQDJCGG.exe
  2⤵
  PID:1324
- C:\Windows\System\NbvWpec.exe
  C:\Windows\System\NbvWpec.exe
  2⤵
  PID:3316
- C:\Windows\System\ITQkzTC.exe
  C:\Windows\System\ITQkzTC.exe
  2⤵
  PID:3392
- C:\Windows\System\naFykCj.exe
  C:\Windows\System\naFykCj.exe
  2⤵
  PID:3208
- C:\Windows\System\hAOwszN.exe
  C:\Windows\System\hAOwszN.exe
  2⤵
  PID:972
- C:\Windows\System\ZYayORC.exe
  C:\Windows\System\ZYayORC.exe
  2⤵
  PID:3436
- C:\Windows\System\dhUmVgR.exe
  C:\Windows\System\dhUmVgR.exe
  2⤵
  PID:3500
- C:\Windows\System\ZYIueZB.exe
  C:\Windows\System\ZYIueZB.exe
  2⤵
  PID:3588
- C:\Windows\System\JuqYMZG.exe
  C:\Windows\System\JuqYMZG.exe
  2⤵
  PID:3652
- C:\Windows\System\KjooABh.exe
  C:\Windows\System\KjooABh.exe
  2⤵
  PID:3700
- C:\Windows\System\fNKaYwU.exe
  C:\Windows\System\fNKaYwU.exe
  2⤵
  PID:3784
- C:\Windows\System\JHIviAQ.exe
  C:\Windows\System\JHIviAQ.exe
  2⤵
  PID:3796
- C:\Windows\System\cSFHhVZ.exe
  C:\Windows\System\cSFHhVZ.exe
  2⤵
  PID:3860
- C:\Windows\System\aPhosKR.exe
  C:\Windows\System\aPhosKR.exe
  2⤵
  PID:3900
- C:\Windows\System\hNhfmwp.exe
  C:\Windows\System\hNhfmwp.exe
  2⤵
  PID:1992
- C:\Windows\System\dnGerQu.exe
  C:\Windows\System\dnGerQu.exe
  2⤵
  PID:2020
- C:\Windows\System\ZmtxVXZ.exe
  C:\Windows\System\ZmtxVXZ.exe
  2⤵
  PID:3912
- C:\Windows\System\MSPQEbr.exe
  C:\Windows\System\MSPQEbr.exe
  2⤵
  PID:3680
- C:\Windows\System\nGzqVPF.exe
  C:\Windows\System\nGzqVPF.exe
  2⤵
  PID:3932
- C:\Windows\System\ItdmxCk.exe
  C:\Windows\System\ItdmxCk.exe
  2⤵
  PID:3516
- C:\Windows\System\chOOyyI.exe
  C:\Windows\System\chOOyyI.exe
  2⤵
  PID:3568
- C:\Windows\System\BmGhuzX.exe
  C:\Windows\System\BmGhuzX.exe
  2⤵
  PID:3640
- C:\Windows\System\ZQJirTo.exe
  C:\Windows\System\ZQJirTo.exe
  2⤵
  PID:3724
- C:\Windows\System\kMXcuMP.exe
  C:\Windows\System\kMXcuMP.exe
  2⤵
  PID:3768
- C:\Windows\System\ybZfNUP.exe
  C:\Windows\System\ybZfNUP.exe
  2⤵
  PID:3844
- C:\Windows\System\zICvQbY.exe
  C:\Windows\System\zICvQbY.exe
  2⤵
  PID:3512
- C:\Windows\System\MCqhYsi.exe
  C:\Windows\System\MCqhYsi.exe
  2⤵
  PID:3976
- C:\Windows\System\FGwIqdY.exe
  C:\Windows\System\FGwIqdY.exe
  2⤵
  PID:4040
- C:\Windows\System\rcMMUhy.exe
  C:\Windows\System\rcMMUhy.exe
  2⤵
  PID:4080
- C:\Windows\System\MEsEvcJ.exe
  C:\Windows\System\MEsEvcJ.exe
  2⤵
  PID:2600
- C:\Windows\System\OjILjyg.exe
  C:\Windows\System\OjILjyg.exe
  2⤵
  PID:3196
- C:\Windows\System\dtupwBU.exe
  C:\Windows\System\dtupwBU.exe
  2⤵
  PID:3404
- C:\Windows\System\EUlMSWn.exe
  C:\Windows\System\EUlMSWn.exe
  2⤵
  PID:3244
- C:\Windows\System\zoyCzgj.exe
  C:\Windows\System\zoyCzgj.exe
  2⤵
  PID:3992
- C:\Windows\System\RMOfCsH.exe
  C:\Windows\System\RMOfCsH.exe
  2⤵
  PID:1300
- C:\Windows\System\iThDqBs.exe
  C:\Windows\System\iThDqBs.exe
  2⤵
  PID:3332
- C:\Windows\System\wlTSuUN.exe
  C:\Windows\System\wlTSuUN.exe
  2⤵
  PID:3356
- C:\Windows\System\dxOAVWM.exe
  C:\Windows\System\dxOAVWM.exe
  2⤵
  PID:1764
- C:\Windows\System\XXbKyjV.exe
  C:\Windows\System\XXbKyjV.exe
  2⤵
  PID:3584
- C:\Windows\System\YmBhBvT.exe
  C:\Windows\System\YmBhBvT.exe
  2⤵
  PID:3788
- C:\Windows\System\xdrpmag.exe
  C:\Windows\System\xdrpmag.exe
  2⤵
  PID:484
- C:\Windows\System\RuDzBIj.exe
  C:\Windows\System\RuDzBIj.exe
  2⤵
  PID:3468
- C:\Windows\System\vpsndlm.exe
  C:\Windows\System\vpsndlm.exe
  2⤵
  PID:3736
- C:\Windows\System\JSJhJop.exe
  C:\Windows\System\JSJhJop.exe
  2⤵
  PID:4012
- C:\Windows\System\BAGXYZt.exe
  C:\Windows\System\BAGXYZt.exe
  2⤵
  PID:3376
- C:\Windows\System\vpBFENp.exe
  C:\Windows\System\vpBFENp.exe
  2⤵
  PID:3620
- C:\Windows\System\TJKCBkK.exe
  C:\Windows\System\TJKCBkK.exe
  2⤵
  PID:3248
- C:\Windows\System\xZfKLSS.exe
  C:\Windows\System\xZfKLSS.exe
  2⤵
  PID:3428
- C:\Windows\System\CEvMNiS.exe
  C:\Windows\System\CEvMNiS.exe
  2⤵
  PID:3528
- C:\Windows\System\IgysbEx.exe
  C:\Windows\System\IgysbEx.exe
  2⤵
  PID:3924
- C:\Windows\System\ugSjsHB.exe
  C:\Windows\System\ugSjsHB.exe
  2⤵
  PID:4024
- C:\Windows\System\BCVWTzi.exe
  C:\Windows\System\BCVWTzi.exe
  2⤵
  PID:3812
- C:\Windows\System\YQlzXIv.exe
  C:\Windows\System\YQlzXIv.exe
  2⤵
  PID:3344
- C:\Windows\System\CfpnydK.exe
  C:\Windows\System\CfpnydK.exe
  2⤵
  PID:4076
- C:\Windows\System\OLqKKCb.exe
  C:\Windows\System\OLqKKCb.exe
  2⤵
  PID:3488
- C:\Windows\System\YKRcNbQ.exe
  C:\Windows\System\YKRcNbQ.exe
  2⤵
  PID:3716
- C:\Windows\System\TNDzkvr.exe
  C:\Windows\System\TNDzkvr.exe
  2⤵
  PID:3076
- C:\Windows\System\cqtodvU.exe
  C:\Windows\System\cqtodvU.exe
  2⤵
  PID:3692
- C:\Windows\System\QAGwluX.exe
  C:\Windows\System\QAGwluX.exe
  2⤵
  PID:3884
- C:\Windows\System\plEAZkp.exe
  C:\Windows\System\plEAZkp.exe
  2⤵
  PID:3960
- C:\Windows\System\kZFiKBU.exe
  C:\Windows\System\kZFiKBU.exe
  2⤵
  PID:3160
- C:\Windows\System\gtFEZYa.exe
  C:\Windows\System\gtFEZYa.exe
  2⤵
  PID:3580
- C:\Windows\System\kUdZllZ.exe
  C:\Windows\System\kUdZllZ.exe
  2⤵
  PID:3092
- C:\Windows\System\ullrIzL.exe
  C:\Windows\System\ullrIzL.exe
  2⤵
  PID:3548
- C:\Windows\System\iJwZbqf.exe
  C:\Windows\System\iJwZbqf.exe
  2⤵
  PID:3636
- C:\Windows\System\wJGlGji.exe
  C:\Windows\System\wJGlGji.exe
  2⤵
  PID:3752
- C:\Windows\System\bSqYgWK.exe
  C:\Windows\System\bSqYgWK.exe
  2⤵
  PID:3564
- C:\Windows\System\pszxWNm.exe
  C:\Windows\System\pszxWNm.exe
  2⤵
  PID:3352
- C:\Windows\System\izsbQDM.exe
  C:\Windows\System\izsbQDM.exe
  2⤵
  PID:3940
- C:\Windows\System\gULxRoG.exe
  C:\Windows\System\gULxRoG.exe
  2⤵
  PID:3264
- C:\Windows\System\lmxFysx.exe
  C:\Windows\System\lmxFysx.exe
  2⤵
  PID:4060
- C:\Windows\System\NMVhUBA.exe
  C:\Windows\System\NMVhUBA.exe
  2⤵
  PID:4108
- C:\Windows\System\RjvcuYr.exe
  C:\Windows\System\RjvcuYr.exe
  2⤵
  PID:4124
- C:\Windows\System\sBDwXEo.exe
  C:\Windows\System\sBDwXEo.exe
  2⤵
  PID:4140
- C:\Windows\System\sAcMRKe.exe
  C:\Windows\System\sAcMRKe.exe
  2⤵
  PID:4156
- C:\Windows\System\aCdtUbn.exe
  C:\Windows\System\aCdtUbn.exe
  2⤵
  PID:4172
- C:\Windows\System\KZcxakF.exe
  C:\Windows\System\KZcxakF.exe
  2⤵
  PID:4188
- C:\Windows\System\VUWAvtL.exe
  C:\Windows\System\VUWAvtL.exe
  2⤵
  PID:4204
- C:\Windows\System\TFcxxVa.exe
  C:\Windows\System\TFcxxVa.exe
  2⤵
  PID:4220
- C:\Windows\System\YTyNxdd.exe
  C:\Windows\System\YTyNxdd.exe
  2⤵
  PID:4236
- C:\Windows\System\zbQuwwa.exe
  C:\Windows\System\zbQuwwa.exe
  2⤵
  PID:4252
- C:\Windows\System\CoacKMF.exe
  C:\Windows\System\CoacKMF.exe
  2⤵
  PID:4268
- C:\Windows\System\nBHmMiy.exe
  C:\Windows\System\nBHmMiy.exe
  2⤵
  PID:4284
- C:\Windows\System\gVuddvo.exe
  C:\Windows\System\gVuddvo.exe
  2⤵
  PID:4300
- C:\Windows\System\hmmRIdL.exe
  C:\Windows\System\hmmRIdL.exe
  2⤵
  PID:4316
- C:\Windows\System\IOaiVvF.exe
  C:\Windows\System\IOaiVvF.exe
  2⤵
  PID:4332
- C:\Windows\System\YBPOCPw.exe
  C:\Windows\System\YBPOCPw.exe
  2⤵
  PID:4348
- C:\Windows\System\WdtKNZV.exe
  C:\Windows\System\WdtKNZV.exe
  2⤵
  PID:4364
- C:\Windows\System\CRNuXpa.exe
  C:\Windows\System\CRNuXpa.exe
  2⤵
  PID:4380
- C:\Windows\System\qBgjqay.exe
  C:\Windows\System\qBgjqay.exe
  2⤵
  PID:4396
- C:\Windows\System\oHOyPNw.exe
  C:\Windows\System\oHOyPNw.exe
  2⤵
  PID:4412
- C:\Windows\System\ogxSxnF.exe
  C:\Windows\System\ogxSxnF.exe
  2⤵
  PID:4428
- C:\Windows\System\VWtWcbI.exe
  C:\Windows\System\VWtWcbI.exe
  2⤵
  PID:4444
- C:\Windows\System\Mcfghen.exe
  C:\Windows\System\Mcfghen.exe
  2⤵
  PID:4460
- C:\Windows\System\musKPqP.exe
  C:\Windows\System\musKPqP.exe
  2⤵
  PID:4476
- C:\Windows\System\XYjXXJP.exe
  C:\Windows\System\XYjXXJP.exe
  2⤵
  PID:4492
- C:\Windows\System\bFkyNmG.exe
  C:\Windows\System\bFkyNmG.exe
  2⤵
  PID:4508
- C:\Windows\System\NnIxErW.exe
  C:\Windows\System\NnIxErW.exe
  2⤵
  PID:4528
- C:\Windows\System\HgHCalv.exe
  C:\Windows\System\HgHCalv.exe
  2⤵
  PID:4544
- C:\Windows\System\wyTCXbA.exe
  C:\Windows\System\wyTCXbA.exe
  2⤵
  PID:4560
- C:\Windows\System\tjyHQAG.exe
  C:\Windows\System\tjyHQAG.exe
  2⤵
  PID:4576
- C:\Windows\System\APFMFke.exe
  C:\Windows\System\APFMFke.exe
  2⤵
  PID:4592
- C:\Windows\System\LNQlxxy.exe
  C:\Windows\System\LNQlxxy.exe
  2⤵
  PID:4608
- C:\Windows\System\TKRbHHD.exe
  C:\Windows\System\TKRbHHD.exe
  2⤵
  PID:4624
- C:\Windows\System\FDYBpyK.exe
  C:\Windows\System\FDYBpyK.exe
  2⤵
  PID:4640
- C:\Windows\System\Nsrtecx.exe
  C:\Windows\System\Nsrtecx.exe
  2⤵
  PID:4656
- C:\Windows\System\RenmUyi.exe
  C:\Windows\System\RenmUyi.exe
  2⤵
  PID:4672
- C:\Windows\System\kpxdycL.exe
  C:\Windows\System\kpxdycL.exe
  2⤵
  PID:4688
- C:\Windows\System\iALkJNa.exe
  C:\Windows\System\iALkJNa.exe
  2⤵
  PID:4704
- C:\Windows\System\YTmPilq.exe
  C:\Windows\System\YTmPilq.exe
  2⤵
  PID:4720
- C:\Windows\System\CwTCKCp.exe
  C:\Windows\System\CwTCKCp.exe
  2⤵
  PID:4736
- C:\Windows\System\RXsNzbr.exe
  C:\Windows\System\RXsNzbr.exe
  2⤵
  PID:4752
- C:\Windows\System\ctDgTQq.exe
  C:\Windows\System\ctDgTQq.exe
  2⤵
  PID:4768
- C:\Windows\System\hHyjJXn.exe
  C:\Windows\System\hHyjJXn.exe
  2⤵
  PID:4784
- C:\Windows\System\UHexKsq.exe
  C:\Windows\System\UHexKsq.exe
  2⤵
  PID:4800
- C:\Windows\System\cDfIszQ.exe
  C:\Windows\System\cDfIszQ.exe
  2⤵
  PID:4816
- C:\Windows\System\BshXDys.exe
  C:\Windows\System\BshXDys.exe
  2⤵
  PID:4832
- C:\Windows\System\rBidqIW.exe
  C:\Windows\System\rBidqIW.exe
  2⤵
  PID:4848
- C:\Windows\System\JpsOCkg.exe
  C:\Windows\System\JpsOCkg.exe
  2⤵
  PID:4864
- C:\Windows\System\YXSknli.exe
  C:\Windows\System\YXSknli.exe
  2⤵
  PID:4880
- C:\Windows\System\kZmaaZn.exe
  C:\Windows\System\kZmaaZn.exe
  2⤵
  PID:4896
- C:\Windows\System\tuOhXaZ.exe
  C:\Windows\System\tuOhXaZ.exe
  2⤵
  PID:4912
- C:\Windows\System\dczvuKX.exe
  C:\Windows\System\dczvuKX.exe
  2⤵
  PID:4928
- C:\Windows\System\qnYcejt.exe
  C:\Windows\System\qnYcejt.exe
  2⤵
  PID:4944
- C:\Windows\System\JEtMWIq.exe
  C:\Windows\System\JEtMWIq.exe
  2⤵
  PID:4960
- C:\Windows\System\mFrvePw.exe
  C:\Windows\System\mFrvePw.exe
  2⤵
  PID:4976
- C:\Windows\System\RaqxLNb.exe
  C:\Windows\System\RaqxLNb.exe
  2⤵
  PID:4992
- C:\Windows\System\FKoulfM.exe
  C:\Windows\System\FKoulfM.exe
  2⤵
  PID:5008
- C:\Windows\System\ukVcQKB.exe
  C:\Windows\System\ukVcQKB.exe
  2⤵
  PID:5024
- C:\Windows\System\OWdjsYy.exe
  C:\Windows\System\OWdjsYy.exe
  2⤵
  PID:5040
- C:\Windows\System\gKqNIZK.exe
  C:\Windows\System\gKqNIZK.exe
  2⤵
  PID:5056
- C:\Windows\System\zZxhgtX.exe
  C:\Windows\System\zZxhgtX.exe
  2⤵
  PID:5072
- C:\Windows\System\UTgNoGP.exe
  C:\Windows\System\UTgNoGP.exe
  2⤵
  PID:5088
- C:\Windows\System\PsKauZK.exe
  C:\Windows\System\PsKauZK.exe
  2⤵
  PID:5104
- C:\Windows\System\RRScusQ.exe
  C:\Windows\System\RRScusQ.exe
  2⤵
  PID:3828
- C:\Windows\System\xAFGaij.exe
  C:\Windows\System\xAFGaij.exe
  2⤵
  PID:4132
- C:\Windows\System\tHPIeqS.exe
  C:\Windows\System\tHPIeqS.exe
  2⤵
  PID:3896
- C:\Windows\System\cuxGekV.exe
  C:\Windows\System\cuxGekV.exe
  2⤵
  PID:4200
- C:\Windows\System\SjlYJHY.exe
  C:\Windows\System\SjlYJHY.exe
  2⤵
  PID:4264
- C:\Windows\System\ehbbsfI.exe
  C:\Windows\System\ehbbsfI.exe
  2⤵
  PID:3676
- C:\Windows\System\BZUZKsS.exe
  C:\Windows\System\BZUZKsS.exe
  2⤵
  PID:4328
- C:\Windows\System\NKtEBCE.exe
  C:\Windows\System\NKtEBCE.exe
  2⤵
  PID:3720
- C:\Windows\System\UwIYRbU.exe
  C:\Windows\System\UwIYRbU.exe
  2⤵
  PID:3832
- C:\Windows\System\lYstlmI.exe
  C:\Windows\System\lYstlmI.exe
  2⤵
  PID:4424
- C:\Windows\System\fACMIZw.exe
  C:\Windows\System\fACMIZw.exe
  2⤵
  PID:4212
- C:\Windows\System\aESvFhY.exe
  C:\Windows\System\aESvFhY.exe
  2⤵
  PID:4180
- C:\Windows\System\ckicnYX.exe
  C:\Windows\System\ckicnYX.exe
  2⤵
  PID:4248
- C:\Windows\System\CDPXTpm.exe
  C:\Windows\System\CDPXTpm.exe
  2⤵
  PID:4312
- C:\Windows\System\SUHOBmS.exe
  C:\Windows\System\SUHOBmS.exe
  2⤵
  PID:4404
- C:\Windows\System\ZXhUeRL.exe
  C:\Windows\System\ZXhUeRL.exe
  2⤵
  PID:4436
- C:\Windows\System\GAxRCkO.exe
  C:\Windows\System\GAxRCkO.exe
  2⤵
  PID:4500
- C:\Windows\System\ZXEWYQr.exe
  C:\Windows\System\ZXEWYQr.exe
  2⤵
  PID:4524
- C:\Windows\System\PLMNGFy.exe
  C:\Windows\System\PLMNGFy.exe
  2⤵
  PID:4556
- C:\Windows\System\cgnSmdN.exe
  C:\Windows\System\cgnSmdN.exe
  2⤵
  PID:4572
- C:\Windows\System\dRRthoq.exe
  C:\Windows\System\dRRthoq.exe
  2⤵
  PID:4680
- C:\Windows\System\WFfbomZ.exe
  C:\Windows\System\WFfbomZ.exe
  2⤵
  PID:4684
- C:\Windows\System\xFlWrnG.exe
  C:\Windows\System\xFlWrnG.exe
  2⤵
  PID:4748
- C:\Windows\System\IZBZGbB.exe
  C:\Windows\System\IZBZGbB.exe
  2⤵
  PID:4808
- C:\Windows\System\wfEgfbo.exe
  C:\Windows\System\wfEgfbo.exe
  2⤵
  PID:4696
- C:\Windows\System\DnviGMq.exe
  C:\Windows\System\DnviGMq.exe
  2⤵
  PID:4844
- C:\Windows\System\NIjLFGn.exe
  C:\Windows\System\NIjLFGn.exe
  2⤵
  PID:4876
- C:\Windows\System\XVzDObH.exe
  C:\Windows\System\XVzDObH.exe
  2⤵
  PID:4792
- C:\Windows\System\mEqiRNr.exe
  C:\Windows\System\mEqiRNr.exe
  2⤵
  PID:4828
- C:\Windows\System\qktlixG.exe
  C:\Windows\System\qktlixG.exe
  2⤵
  PID:4892
- C:\Windows\System\gtHpFOQ.exe
  C:\Windows\System\gtHpFOQ.exe
  2⤵
  PID:4972
- C:\Windows\System\YuhCEVd.exe
  C:\Windows\System\YuhCEVd.exe
  2⤵
  PID:5004
- C:\Windows\System\CylccYW.exe
  C:\Windows\System\CylccYW.exe
  2⤵
  PID:4956
- C:\Windows\System\KnLnYuu.exe
  C:\Windows\System\KnLnYuu.exe
  2⤵
  PID:5096
- C:\Windows\System\gAcZVjO.exe
  C:\Windows\System\gAcZVjO.exe
  2⤵
  PID:4988
- C:\Windows\System\TUAtcQl.exe
  C:\Windows\System\TUAtcQl.exe
  2⤵
  PID:3328
- C:\Windows\System\XEdruSK.exe
  C:\Windows\System\XEdruSK.exe
  2⤵
  PID:4164
- C:\Windows\System\JOYIhkT.exe
  C:\Windows\System\JOYIhkT.exe
  2⤵
  PID:5020
- C:\Windows\System\cULGpnH.exe
  C:\Windows\System\cULGpnH.exe
  2⤵
  PID:5084
- C:\Windows\System\fBkvUrc.exe
  C:\Windows\System\fBkvUrc.exe
  2⤵
  PID:3124
- C:\Windows\System\RSFnJEr.exe
  C:\Windows\System\RSFnJEr.exe
  2⤵
  PID:2276
- C:\Windows\System\TWgqJWp.exe
  C:\Windows\System\TWgqJWp.exe
  2⤵
  PID:4280
- C:\Windows\System\OIYbdik.exe
  C:\Windows\System\OIYbdik.exe
  2⤵
  PID:4488
- C:\Windows\System\FkKCdrU.exe
  C:\Windows\System\FkKCdrU.exe
  2⤵
  PID:4604
- C:\Windows\System\bSrSMDI.exe
  C:\Windows\System\bSrSMDI.exe
  2⤵
  PID:4344
- C:\Windows\System\SCUWSTn.exe
  C:\Windows\System\SCUWSTn.exe
  2⤵
  PID:4648
- C:\Windows\System\TAUZKSN.exe
  C:\Windows\System\TAUZKSN.exe
  2⤵
  PID:4468
- C:\Windows\System\oIKYZCi.exe
  C:\Windows\System\oIKYZCi.exe
  2⤵
  PID:4632
- C:\Windows\System\meOJPDD.exe
  C:\Windows\System\meOJPDD.exe
  2⤵
  PID:4732
- C:\Windows\System\KBYWhOB.exe
  C:\Windows\System\KBYWhOB.exe
  2⤵
  PID:4872
- C:\Windows\System\vzCBGFx.exe
  C:\Windows\System\vzCBGFx.exe
  2⤵
  PID:4888
- C:\Windows\System\FwGlFFT.exe
  C:\Windows\System\FwGlFFT.exe
  2⤵
  PID:4940
- C:\Windows\System\rgGHloH.exe
  C:\Windows\System\rgGHloH.exe
  2⤵
  PID:5036
- C:\Windows\System\hzrbEOs.exe
  C:\Windows\System\hzrbEOs.exe
  2⤵
  PID:4984
- C:\Windows\System\HTzPkqE.exe
  C:\Windows\System\HTzPkqE.exe
  2⤵
  PID:4260
- C:\Windows\System\NuMjLhX.exe
  C:\Windows\System\NuMjLhX.exe
  2⤵
  PID:4616
- C:\Windows\System\haMWmXr.exe
  C:\Windows\System\haMWmXr.exe
  2⤵
  PID:4552
- C:\Windows\System\qfxiFRG.exe
  C:\Windows\System\qfxiFRG.exe
  2⤵
  PID:4924
- C:\Windows\System\CKObzTl.exe
  C:\Windows\System\CKObzTl.exe
  2⤵
  PID:4408
- C:\Windows\System\XxIpuOk.exe
  C:\Windows\System\XxIpuOk.exe
  2⤵
  PID:5112
- C:\Windows\System\mCxkCqC.exe
  C:\Windows\System\mCxkCqC.exe
  2⤵
  PID:5124
- C:\Windows\System\YgYQbut.exe
  C:\Windows\System\YgYQbut.exe
  2⤵
  PID:5140
- C:\Windows\System\HweUSPb.exe
  C:\Windows\System\HweUSPb.exe
  2⤵
  PID:5156
- C:\Windows\System\vJYMbFW.exe
  C:\Windows\System\vJYMbFW.exe
  2⤵
  PID:5172
- C:\Windows\System\rovWqZZ.exe
  C:\Windows\System\rovWqZZ.exe
  2⤵
  PID:5188
- C:\Windows\System\nJadmPa.exe
  C:\Windows\System\nJadmPa.exe
  2⤵
  PID:5204
- C:\Windows\System\XRwomKf.exe
  C:\Windows\System\XRwomKf.exe
  2⤵
  PID:5220
- C:\Windows\System\cdkBXkE.exe
  C:\Windows\System\cdkBXkE.exe
  2⤵
  PID:5236
- C:\Windows\System\xczdNKK.exe
  C:\Windows\System\xczdNKK.exe
  2⤵
  PID:5252
- C:\Windows\System\FmpsEjk.exe
  C:\Windows\System\FmpsEjk.exe
  2⤵
  PID:5268
- C:\Windows\System\yhfDJkT.exe
  C:\Windows\System\yhfDJkT.exe
  2⤵
  PID:5284
- C:\Windows\System\yEiPOJh.exe
  C:\Windows\System\yEiPOJh.exe
  2⤵
  PID:5300
- C:\Windows\System\YFsySFJ.exe
  C:\Windows\System\YFsySFJ.exe
  2⤵
  PID:5316
- C:\Windows\System\DtEuFxk.exe
  C:\Windows\System\DtEuFxk.exe
  2⤵
  PID:5332
- C:\Windows\System\rjJIlQN.exe
  C:\Windows\System\rjJIlQN.exe
  2⤵
  PID:5348
- C:\Windows\System\unWKZMG.exe
  C:\Windows\System\unWKZMG.exe
  2⤵
  PID:5364
- C:\Windows\System\aXPfcVU.exe
  C:\Windows\System\aXPfcVU.exe
  2⤵
  PID:5380
- C:\Windows\System\kAJVmgy.exe
  C:\Windows\System\kAJVmgy.exe
  2⤵
  PID:5396
- C:\Windows\System\UnTYCWd.exe
  C:\Windows\System\UnTYCWd.exe
  2⤵
  PID:5412
- C:\Windows\System\LcaYjCF.exe
  C:\Windows\System\LcaYjCF.exe
  2⤵
  PID:5428
- C:\Windows\System\oCHJwRO.exe
  C:\Windows\System\oCHJwRO.exe
  2⤵
  PID:5444
- C:\Windows\System\ltaHteW.exe
  C:\Windows\System\ltaHteW.exe
  2⤵
  PID:5460
- C:\Windows\System\Knosebx.exe
  C:\Windows\System\Knosebx.exe
  2⤵
  PID:5476
- C:\Windows\System\ueJwLwb.exe
  C:\Windows\System\ueJwLwb.exe
  2⤵
  PID:5492
- C:\Windows\System\rItySmE.exe
  C:\Windows\System\rItySmE.exe
  2⤵
  PID:5508
- C:\Windows\System\vthVVeX.exe
  C:\Windows\System\vthVVeX.exe
  2⤵
  PID:5524
- C:\Windows\System\CAqUZSs.exe
  C:\Windows\System\CAqUZSs.exe
  2⤵
  PID:5540
- C:\Windows\System\SOxQRac.exe
  C:\Windows\System\SOxQRac.exe
  2⤵
  PID:5556
- C:\Windows\System\GjjeMMH.exe
  C:\Windows\System\GjjeMMH.exe
  2⤵
  PID:5572
- C:\Windows\System\UuVbvKW.exe
  C:\Windows\System\UuVbvKW.exe
  2⤵
  PID:5588
- C:\Windows\System\mdOMaID.exe
  C:\Windows\System\mdOMaID.exe
  2⤵
  PID:5604
- C:\Windows\System\wSStVbO.exe
  C:\Windows\System\wSStVbO.exe
  2⤵
  PID:5620
- C:\Windows\System\CBnLbQj.exe
  C:\Windows\System\CBnLbQj.exe
  2⤵
  PID:5636
- C:\Windows\System\StEsiYq.exe
  C:\Windows\System\StEsiYq.exe
  2⤵
  PID:5652
- C:\Windows\System\LEKlhmN.exe
  C:\Windows\System\LEKlhmN.exe
  2⤵
  PID:5668
- C:\Windows\System\NevVDoH.exe
  C:\Windows\System\NevVDoH.exe
  2⤵
  PID:5684
- C:\Windows\System\IOCOZvk.exe
  C:\Windows\System\IOCOZvk.exe
  2⤵
  PID:5700
- C:\Windows\System\eUscksl.exe
  C:\Windows\System\eUscksl.exe
  2⤵
  PID:5716
- C:\Windows\System\WwxZipB.exe
  C:\Windows\System\WwxZipB.exe
  2⤵
  PID:5732
- C:\Windows\System\EmRWPRz.exe
  C:\Windows\System\EmRWPRz.exe
  2⤵
  PID:5748
- C:\Windows\System\HTAZXNq.exe
  C:\Windows\System\HTAZXNq.exe
  2⤵
  PID:5764
- C:\Windows\System\CrgXQFC.exe
  C:\Windows\System\CrgXQFC.exe
  2⤵
  PID:5780
- C:\Windows\System\nMlyMoU.exe
  C:\Windows\System\nMlyMoU.exe
  2⤵
  PID:5796
- C:\Windows\System\nLcQoUd.exe
  C:\Windows\System\nLcQoUd.exe
  2⤵
  PID:5812
- C:\Windows\System\PzHjISG.exe
  C:\Windows\System\PzHjISG.exe
  2⤵
  PID:5828
- C:\Windows\System\ZqNNqtK.exe
  C:\Windows\System\ZqNNqtK.exe
  2⤵
  PID:5844
- C:\Windows\System\jCBhBsM.exe
  C:\Windows\System\jCBhBsM.exe
  2⤵
  PID:5860
- C:\Windows\System\BMmVZMi.exe
  C:\Windows\System\BMmVZMi.exe
  2⤵
  PID:5876
- C:\Windows\System\QKDEGlh.exe
  C:\Windows\System\QKDEGlh.exe
  2⤵
  PID:5892
- C:\Windows\System\wdikNEg.exe
  C:\Windows\System\wdikNEg.exe
  2⤵
  PID:5908
- C:\Windows\System\SxpskCS.exe
  C:\Windows\System\SxpskCS.exe
  2⤵
  PID:5924
- C:\Windows\System\efAxvWW.exe
  C:\Windows\System\efAxvWW.exe
  2⤵
  PID:5940
- C:\Windows\System\TlkAtiA.exe
  C:\Windows\System\TlkAtiA.exe
  2⤵
  PID:5956
- C:\Windows\System\ErFqaRz.exe
  C:\Windows\System\ErFqaRz.exe
  2⤵
  PID:5972
- C:\Windows\System\almjawR.exe
  C:\Windows\System\almjawR.exe
  2⤵
  PID:5988
- C:\Windows\System\EGnWwls.exe
  C:\Windows\System\EGnWwls.exe
  2⤵
  PID:6004
- C:\Windows\System\CIcIcVr.exe
  C:\Windows\System\CIcIcVr.exe
  2⤵
  PID:6020
- C:\Windows\System\YmjSISJ.exe
  C:\Windows\System\YmjSISJ.exe
  2⤵
  PID:6036
- C:\Windows\System\meEvKru.exe
  C:\Windows\System\meEvKru.exe
  2⤵
  PID:6052
- C:\Windows\System\aUTpGaB.exe
  C:\Windows\System\aUTpGaB.exe
  2⤵
  PID:6068
- C:\Windows\System\ImupaoF.exe
  C:\Windows\System\ImupaoF.exe
  2⤵
  PID:6084
- C:\Windows\System\LpkwEyH.exe
  C:\Windows\System\LpkwEyH.exe
  2⤵
  PID:6100
- C:\Windows\System\BvbdjRc.exe
  C:\Windows\System\BvbdjRc.exe
  2⤵
  PID:6116
- C:\Windows\System\ojfCGZI.exe
  C:\Windows\System\ojfCGZI.exe
  2⤵
  PID:6132
- C:\Windows\System\cvhUIaX.exe
  C:\Windows\System\cvhUIaX.exe
  2⤵
  PID:5136
- C:\Windows\System\ciKbLDa.exe
  C:\Windows\System\ciKbLDa.exe
  2⤵
  PID:5196
- C:\Windows\System\vFDcQne.exe
  C:\Windows\System\vFDcQne.exe
  2⤵
  PID:4908
- C:\Windows\System\NLztnwD.exe
  C:\Windows\System\NLztnwD.exe
  2⤵
  PID:5228
- C:\Windows\System\dMkcPXw.exe
  C:\Windows\System\dMkcPXw.exe
  2⤵
  PID:5264
- C:\Windows\System\uLhhSqW.exe
  C:\Windows\System\uLhhSqW.exe
  2⤵
  PID:5328
- C:\Windows\System\xiMjYqf.exe
  C:\Windows\System\xiMjYqf.exe
  2⤵
  PID:5184
- C:\Windows\System\bHvvpVO.exe
  C:\Windows\System\bHvvpVO.exe
  2⤵
  PID:5420
- C:\Windows\System\tZUsjLw.exe
  C:\Windows\System\tZUsjLw.exe
  2⤵
  PID:5388
- C:\Windows\System\AhftCsF.exe
  C:\Windows\System\AhftCsF.exe
  2⤵
  PID:4232
- C:\Windows\System\DOsKAap.exe
  C:\Windows\System\DOsKAap.exe
  2⤵
  PID:4376
- C:\Windows\System\tPqPOoz.exe
  C:\Windows\System\tPqPOoz.exe
  2⤵
  PID:4152
- C:\Windows\System\cZosgEs.exe
  C:\Windows\System\cZosgEs.exe
  2⤵
  PID:5436
- C:\Windows\System\BrPpkWH.exe
  C:\Windows\System\BrPpkWH.exe
  2⤵
  PID:5276
- C:\Windows\System\psshszI.exe
  C:\Windows\System\psshszI.exe
  2⤵
  PID:5340
- C:\Windows\System\lYWkqbm.exe
  C:\Windows\System\lYWkqbm.exe
  2⤵
  PID:5372
- C:\Windows\System\ZrpAZEq.exe
  C:\Windows\System\ZrpAZEq.exe
  2⤵
  PID:5468
- C:\Windows\System\pAazRXp.exe
  C:\Windows\System\pAazRXp.exe
  2⤵
  PID:5520
- C:\Windows\System\DyNgltx.exe
  C:\Windows\System\DyNgltx.exe
  2⤵
  PID:5584
- C:\Windows\System\iCJuOJA.exe
  C:\Windows\System\iCJuOJA.exe
  2⤵
  PID:5504
- C:\Windows\System\sChQfDR.exe
  C:\Windows\System\sChQfDR.exe
  2⤵
  PID:5648
- C:\Windows\System\DUydqjk.exe
  C:\Windows\System\DUydqjk.exe
  2⤵
  PID:5596
- C:\Windows\System\MhESPJe.exe
  C:\Windows\System\MhESPJe.exe
  2⤵
  PID:5836
- C:\Windows\System\PzYStwX.exe
  C:\Windows\System\PzYStwX.exe
  2⤵
  PID:5740
- C:\Windows\System\LjrRDyK.exe
  C:\Windows\System\LjrRDyK.exe
  2⤵
  PID:5840
- C:\Windows\System\vjvBYKf.exe
  C:\Windows\System\vjvBYKf.exe
  2⤵
  PID:5900
- C:\Windows\System\jItMOgL.exe
  C:\Windows\System\jItMOgL.exe
  2⤵
  PID:5964
- C:\Windows\System\BRbpccu.exe
  C:\Windows\System\BRbpccu.exe
  2⤵
  PID:5632
- C:\Windows\System\buHkrmd.exe
  C:\Windows\System\buHkrmd.exe
  2⤵
  PID:6028
- C:\Windows\System\KeVtYGG.exe
  C:\Windows\System\KeVtYGG.exe
  2⤵
  PID:6092
- C:\Windows\System\LFtoteY.exe
  C:\Windows\System\LFtoteY.exe
  2⤵
  PID:5164
- C:\Windows\System\DRRKCYz.exe
  C:\Windows\System\DRRKCYz.exe
  2⤵
  PID:5168
- C:\Windows\System\ECWjRhM.exe
  C:\Windows\System\ECWjRhM.exe
  2⤵
  PID:5200
- C:\Windows\System\iMzDbHo.exe
  C:\Windows\System\iMzDbHo.exe
  2⤵
  PID:5888
- C:\Windows\System\QXYSsKm.exe
  C:\Windows\System\QXYSsKm.exe
  2⤵
  PID:5952
- C:\Windows\System\PaEeoSR.exe
  C:\Windows\System\PaEeoSR.exe
  2⤵
  PID:6016
- C:\Windows\System\pYrQrPY.exe
  C:\Windows\System\pYrQrPY.exe
  2⤵
  PID:6076
- C:\Windows\System\EKKDIYE.exe
  C:\Windows\System\EKKDIYE.exe
  2⤵
  PID:6140
- C:\Windows\System\nyCgRfV.exe
  C:\Windows\System\nyCgRfV.exe
  2⤵
  PID:5696
- C:\Windows\System\EsxCciY.exe
  C:\Windows\System\EsxCciY.exe
  2⤵
  PID:4664
- C:\Windows\System\kmSEjGi.exe
  C:\Windows\System\kmSEjGi.exe
  2⤵
  PID:5360
- C:\Windows\System\itIyACW.exe
  C:\Windows\System\itIyACW.exe
  2⤵
  PID:5424
- C:\Windows\System\PpYoGXt.exe
  C:\Windows\System\PpYoGXt.exe
  2⤵
  PID:5244
- C:\Windows\System\wHrrEUb.exe
  C:\Windows\System\wHrrEUb.exe
  2⤵
  PID:4120
- C:\Windows\System\LGBeBWQ.exe
  C:\Windows\System\LGBeBWQ.exe
  2⤵
  PID:5532
- C:\Windows\System\giRNTqo.exe
  C:\Windows\System\giRNTqo.exe
  2⤵
  PID:5452
- C:\Windows\System\UTezuHe.exe
  C:\Windows\System\UTezuHe.exe
  2⤵
  PID:5216
- C:\Windows\System\znKbXdH.exe
  C:\Windows\System\znKbXdH.exe
  2⤵
  PID:5616
- C:\Windows\System\KHRcCGC.exe
  C:\Windows\System\KHRcCGC.exe
  2⤵
  PID:5712
- C:\Windows\System\EGrVWqE.exe
  C:\Windows\System\EGrVWqE.exe
  2⤵
  PID:5872
- C:\Windows\System\aaAFFQQ.exe
  C:\Windows\System\aaAFFQQ.exe
  2⤵
  PID:6064
- C:\Windows\System\icALccC.exe
  C:\Windows\System\icALccC.exe
  2⤵
  PID:5824
- C:\Windows\System\HSuDcCk.exe
  C:\Windows\System\HSuDcCk.exe
  2⤵
  PID:5080
- C:\Windows\System\ECoEvjJ.exe
  C:\Windows\System\ECoEvjJ.exe
  2⤵
  PID:5600
- C:\Windows\System\IxGJYBL.exe
  C:\Windows\System\IxGJYBL.exe
  2⤵
  PID:5984
- C:\Windows\System\OJUOhiv.exe
  C:\Windows\System\OJUOhiv.exe
  2⤵
  PID:5728
- C:\Windows\System\CODXmtP.exe
  C:\Windows\System\CODXmtP.exe
  2⤵
  PID:5312
- C:\Windows\System\hDLZZKo.exe
  C:\Windows\System\hDLZZKo.exe
  2⤵
  PID:5152
- C:\Windows\System\aruSzSl.exe
  C:\Windows\System\aruSzSl.exe
  2⤵
  PID:5868
- C:\Windows\System\TvooIlA.exe
  C:\Windows\System\TvooIlA.exe
  2⤵
  PID:5772
- C:\Windows\System\rnoVLzi.exe
  C:\Windows\System\rnoVLzi.exe
  2⤵
  PID:4308
- C:\Windows\System\irZPfKR.exe
  C:\Windows\System\irZPfKR.exe
  2⤵
  PID:5932
- C:\Windows\System\DPcMszk.exe
  C:\Windows\System\DPcMszk.exe
  2⤵
  PID:5792
- C:\Windows\System\HrGPTwn.exe
  C:\Windows\System\HrGPTwn.exe
  2⤵
  PID:5132
- C:\Windows\System\MJDnhYv.exe
  C:\Windows\System\MJDnhYv.exe
  2⤵
  PID:5580
- C:\Windows\System\MnJJhRF.exe
  C:\Windows\System\MnJJhRF.exe
  2⤵
  PID:5680
- C:\Windows\System\wKpmNiS.exe
  C:\Windows\System\wKpmNiS.exe
  2⤵
  PID:5856
- C:\Windows\System\IhVimOH.exe
  C:\Windows\System\IhVimOH.exe
  2⤵
  PID:5516
- C:\Windows\System\hAVaNBt.exe
  C:\Windows\System\hAVaNBt.exe
  2⤵
  PID:6124
- C:\Windows\System\KNbTtst.exe
  C:\Windows\System\KNbTtst.exe
  2⤵
  PID:4296
- C:\Windows\System\FSVKriA.exe
  C:\Windows\System\FSVKriA.exe
  2⤵
  PID:6160
- C:\Windows\System\ZoFVMDF.exe
  C:\Windows\System\ZoFVMDF.exe
  2⤵
  PID:6176
- C:\Windows\System\HSfZNoq.exe
  C:\Windows\System\HSfZNoq.exe
  2⤵
  PID:6192
- C:\Windows\System\pjdSZSN.exe
  C:\Windows\System\pjdSZSN.exe
  2⤵
  PID:6208
- C:\Windows\System\CTzCJvK.exe
  C:\Windows\System\CTzCJvK.exe
  2⤵
  PID:6224
- C:\Windows\System\RLnlBNl.exe
  C:\Windows\System\RLnlBNl.exe
  2⤵
  PID:6240
- C:\Windows\System\CjINXDp.exe
  C:\Windows\System\CjINXDp.exe
  2⤵
  PID:6256
- C:\Windows\System\FqniOzD.exe
  C:\Windows\System\FqniOzD.exe
  2⤵
  PID:6272
- C:\Windows\System\fUDlnCl.exe
  C:\Windows\System\fUDlnCl.exe
  2⤵
  PID:6288
- C:\Windows\System\zFeKciU.exe
  C:\Windows\System\zFeKciU.exe
  2⤵
  PID:6304
- C:\Windows\System\lwGnRiD.exe
  C:\Windows\System\lwGnRiD.exe
  2⤵
  PID:6320
- C:\Windows\System\Fycwuzl.exe
  C:\Windows\System\Fycwuzl.exe
  2⤵
  PID:6336
- C:\Windows\System\cmNOIOE.exe
  C:\Windows\System\cmNOIOE.exe
  2⤵
  PID:6352
- C:\Windows\System\yUeNVvO.exe
  C:\Windows\System\yUeNVvO.exe
  2⤵
  PID:6368
- C:\Windows\System\UlzGiVB.exe
  C:\Windows\System\UlzGiVB.exe
  2⤵
  PID:6384
- C:\Windows\System\JvkVBiL.exe
  C:\Windows\System\JvkVBiL.exe
  2⤵
  PID:6400
- C:\Windows\System\lCwQJgJ.exe
  C:\Windows\System\lCwQJgJ.exe
  2⤵
  PID:6416
- C:\Windows\System\KOzowhY.exe
  C:\Windows\System\KOzowhY.exe
  2⤵
  PID:6432
- C:\Windows\System\fCIZWmw.exe
  C:\Windows\System\fCIZWmw.exe
  2⤵
  PID:6448
- C:\Windows\System\OgleHHZ.exe
  C:\Windows\System\OgleHHZ.exe
  2⤵
  PID:6464
- C:\Windows\System\GVvFDwp.exe
  C:\Windows\System\GVvFDwp.exe
  2⤵
  PID:6480
- C:\Windows\System\cbLDiJN.exe
  C:\Windows\System\cbLDiJN.exe
  2⤵
  PID:6496
- C:\Windows\System\vrjpaFo.exe
  C:\Windows\System\vrjpaFo.exe
  2⤵
  PID:6512
- C:\Windows\System\JfPuwhJ.exe
  C:\Windows\System\JfPuwhJ.exe
  2⤵
  PID:6528
- C:\Windows\System\KIkwdYs.exe
  C:\Windows\System\KIkwdYs.exe
  2⤵
  PID:6544
- C:\Windows\System\KjgLPuj.exe
  C:\Windows\System\KjgLPuj.exe
  2⤵
  PID:6560
- C:\Windows\System\WAAcGAE.exe
  C:\Windows\System\WAAcGAE.exe
  2⤵
  PID:6576
- C:\Windows\System\xmRlJDY.exe
  C:\Windows\System\xmRlJDY.exe
  2⤵
  PID:6592
- C:\Windows\System\enHFTkk.exe
  C:\Windows\System\enHFTkk.exe
  2⤵
  PID:6608
- C:\Windows\System\jSCNVDY.exe
  C:\Windows\System\jSCNVDY.exe
  2⤵
  PID:6624
- C:\Windows\System\JBdmyEa.exe
  C:\Windows\System\JBdmyEa.exe
  2⤵
  PID:6640
- C:\Windows\System\OFPYKDk.exe
  C:\Windows\System\OFPYKDk.exe
  2⤵
  PID:6656
- C:\Windows\System\HLXuEGk.exe
  C:\Windows\System\HLXuEGk.exe
  2⤵
  PID:6672
- C:\Windows\System\sEWFVAW.exe
  C:\Windows\System\sEWFVAW.exe
  2⤵
  PID:6688
- C:\Windows\System\iuSKqGX.exe
  C:\Windows\System\iuSKqGX.exe
  2⤵
  PID:6704
- C:\Windows\System\xDEQOAl.exe
  C:\Windows\System\xDEQOAl.exe
  2⤵
  PID:6720
- C:\Windows\System\IHPQPNb.exe
  C:\Windows\System\IHPQPNb.exe
  2⤵
  PID:6736
- C:\Windows\System\SDDcCeh.exe
  C:\Windows\System\SDDcCeh.exe
  2⤵
  PID:6752
- C:\Windows\System\DEjpjdM.exe
  C:\Windows\System\DEjpjdM.exe
  2⤵
  PID:6768
- C:\Windows\System\pzCGSpK.exe
  C:\Windows\System\pzCGSpK.exe
  2⤵
  PID:6784
- C:\Windows\System\PLsdfbm.exe
  C:\Windows\System\PLsdfbm.exe
  2⤵
  PID:6800
- C:\Windows\System\NlWdSbW.exe
  C:\Windows\System\NlWdSbW.exe
  2⤵
  PID:6816
- C:\Windows\System\cAFtJNs.exe
  C:\Windows\System\cAFtJNs.exe
  2⤵
  PID:6832
- C:\Windows\System\kBZyvwl.exe
  C:\Windows\System\kBZyvwl.exe
  2⤵
  PID:6848
- C:\Windows\System\XkZbuAG.exe
  C:\Windows\System\XkZbuAG.exe
  2⤵
  PID:6864
- C:\Windows\System\OUOXhiH.exe
  C:\Windows\System\OUOXhiH.exe
  2⤵
  PID:6880
- C:\Windows\System\GPRRxTh.exe
  C:\Windows\System\GPRRxTh.exe
  2⤵
  PID:6896
- C:\Windows\System\hKJLWwM.exe
  C:\Windows\System\hKJLWwM.exe
  2⤵
  PID:6912
- C:\Windows\System\VPOCDGr.exe
  C:\Windows\System\VPOCDGr.exe
  2⤵
  PID:6928
- C:\Windows\System\PsFhbnU.exe
  C:\Windows\System\PsFhbnU.exe
  2⤵
  PID:6948
- C:\Windows\System\PwdgHkA.exe
  C:\Windows\System\PwdgHkA.exe
  2⤵
  PID:6964
- C:\Windows\System\mUHTuXh.exe
  C:\Windows\System\mUHTuXh.exe
  2⤵
  PID:6980
- C:\Windows\System\cAbJzwz.exe
  C:\Windows\System\cAbJzwz.exe
  2⤵
  PID:6996
- C:\Windows\System\hertuHz.exe
  C:\Windows\System\hertuHz.exe
  2⤵
  PID:7012
- C:\Windows\System\lkagpSs.exe
  C:\Windows\System\lkagpSs.exe
  2⤵
  PID:7028
- C:\Windows\System\KigIMMz.exe
  C:\Windows\System\KigIMMz.exe
  2⤵
  PID:7044
- C:\Windows\System\AFFhySj.exe
  C:\Windows\System\AFFhySj.exe
  2⤵
  PID:7060
- C:\Windows\System\hKhkykz.exe
  C:\Windows\System\hKhkykz.exe
  2⤵
  PID:7076
- C:\Windows\System\lPcGutY.exe
  C:\Windows\System\lPcGutY.exe
  2⤵
  PID:7092
- C:\Windows\System\Suwvsvz.exe
  C:\Windows\System\Suwvsvz.exe
  2⤵
  PID:7108
- C:\Windows\System\alueRrN.exe
  C:\Windows\System\alueRrN.exe
  2⤵
  PID:7124
- C:\Windows\System\IYYKoyc.exe
  C:\Windows\System\IYYKoyc.exe
  2⤵
  PID:7140
- C:\Windows\System\NuHbxsY.exe
  C:\Windows\System\NuHbxsY.exe
  2⤵
  PID:7156
- C:\Windows\System\nkGSLMZ.exe
  C:\Windows\System\nkGSLMZ.exe
  2⤵
  PID:5100
- C:\Windows\System\dgiYbIg.exe
  C:\Windows\System\dgiYbIg.exe
  2⤵
  PID:6080
- C:\Windows\System\ubsjQxz.exe
  C:\Windows\System\ubsjQxz.exe
  2⤵
  PID:6232
- C:\Windows\System\hkYLqXs.exe
  C:\Windows\System\hkYLqXs.exe
  2⤵
  PID:5408
- C:\Windows\System\OEnmRQm.exe
  C:\Windows\System\OEnmRQm.exe
  2⤵
  PID:5628
- C:\Windows\System\OpIACCH.exe
  C:\Windows\System\OpIACCH.exe
  2⤵
  PID:6220
- C:\Windows\System\lvXUXoL.exe
  C:\Windows\System\lvXUXoL.exe
  2⤵
  PID:6296
- C:\Windows\System\PAISAfA.exe
  C:\Windows\System\PAISAfA.exe
  2⤵
  PID:6284
- C:\Windows\System\ipqtzmz.exe
  C:\Windows\System\ipqtzmz.exe
  2⤵
  PID:6360
- C:\Windows\System\QHftXOV.exe
  C:\Windows\System\QHftXOV.exe
  2⤵
  PID:6424
- C:\Windows\System\lHasYCk.exe
  C:\Windows\System\lHasYCk.exe
  2⤵
  PID:6412
- C:\Windows\System\vamzQbt.exe
  C:\Windows\System\vamzQbt.exe
  2⤵
  PID:6376
- C:\Windows\System\sPOVYMg.exe
  C:\Windows\System\sPOVYMg.exe
  2⤵
  PID:6444
- C:\Windows\System\SurpqGs.exe
  C:\Windows\System\SurpqGs.exe
  2⤵
  PID:6488
- C:\Windows\System\TYFOHUp.exe
  C:\Windows\System\TYFOHUp.exe
  2⤵
  PID:6520
- C:\Windows\System\anqpnso.exe
  C:\Windows\System\anqpnso.exe
  2⤵
  PID:6536
- C:\Windows\System\kXMjkch.exe
  C:\Windows\System\kXMjkch.exe
  2⤵
  PID:6616
- C:\Windows\System\WaYdRzb.exe
  C:\Windows\System\WaYdRzb.exe
  2⤵
  PID:6680
- C:\Windows\System\VkSZZnM.exe
  C:\Windows\System\VkSZZnM.exe
  2⤵
  PID:6716
- C:\Windows\System\RXeGxXW.exe
  C:\Windows\System\RXeGxXW.exe
  2⤵
  PID:6780
- C:\Windows\System\VTnKDUN.exe
  C:\Windows\System\VTnKDUN.exe
  2⤵
  PID:6840
- C:\Windows\System\GuKnaXT.exe
  C:\Windows\System\GuKnaXT.exe
  2⤵
  PID:6872
- C:\Windows\System\yPxbbUs.exe
  C:\Windows\System\yPxbbUs.exe
  2⤵
  PID:6732
- C:\Windows\System\bvoOncq.exe
  C:\Windows\System\bvoOncq.exe
  2⤵
  PID:6972
- C:\Windows\System\GNPrnnp.exe
  C:\Windows\System\GNPrnnp.exe
  2⤵
  PID:6632
- C:\Windows\System\NZLIlIW.exe
  C:\Windows\System\NZLIlIW.exe
  2⤵
  PID:6668
- C:\Windows\System\QzofiMM.exe
  C:\Windows\System\QzofiMM.exe
  2⤵
  PID:6760
- C:\Windows\System\aHgSFGl.exe
  C:\Windows\System\aHgSFGl.exe
  2⤵
  PID:6824
- C:\Windows\System\jvkDMoO.exe
  C:\Windows\System\jvkDMoO.exe
  2⤵
  PID:7036
- C:\Windows\System\NsRicAy.exe
  C:\Windows\System\NsRicAy.exe
  2⤵
  PID:6892
- C:\Windows\System\LjnRxGm.exe
  C:\Windows\System\LjnRxGm.exe
  2⤵
  PID:7132
- C:\Windows\System\VAWbqBC.exe
  C:\Windows\System\VAWbqBC.exe
  2⤵
  PID:5936
- C:\Windows\System\OwySARg.exe
  C:\Windows\System\OwySARg.exe
  2⤵
  PID:6168
- C:\Windows\System\nqARZiR.exe
  C:\Windows\System\nqARZiR.exe
  2⤵
  PID:6200
- C:\Windows\System\jurlUrL.exe
  C:\Windows\System\jurlUrL.exe
  2⤵
  PID:7084
- C:\Windows\System\RuZhBgH.exe
  C:\Windows\System\RuZhBgH.exe
  2⤵
  PID:6172
- C:\Windows\System\zfkaECy.exe
  C:\Windows\System\zfkaECy.exe
  2⤵
  PID:5308
- C:\Windows\System\PurNPSs.exe
  C:\Windows\System\PurNPSs.exe
  2⤵
  PID:6332
- C:\Windows\System\qrGOcrX.exe
  C:\Windows\System\qrGOcrX.exe
  2⤵
  PID:6264
- C:\Windows\System\qwRASGL.exe
  C:\Windows\System\qwRASGL.exe
  2⤵
  PID:6248
- C:\Windows\System\mhaJFfs.exe
  C:\Windows\System\mhaJFfs.exe
  2⤵
  PID:6316
- C:\Windows\System\yFNnfDh.exe
  C:\Windows\System\yFNnfDh.exe
  2⤵
  PID:6588
- C:\Windows\System\CFqHytr.exe
  C:\Windows\System\CFqHytr.exe
  2⤵
  PID:6684
- C:\Windows\System\cuzUYTi.exe
  C:\Windows\System\cuzUYTi.exe
  2⤵
  PID:6552
- C:\Windows\System\vvDHFvx.exe
  C:\Windows\System\vvDHFvx.exe
  2⤵
  PID:6904
- C:\Windows\System\RDIjRAT.exe
  C:\Windows\System\RDIjRAT.exe
  2⤵
  PID:6700
- C:\Windows\System\oKqdUio.exe
  C:\Windows\System\oKqdUio.exe
  2⤵
  PID:6860
- C:\Windows\System\cGnnaop.exe
  C:\Windows\System\cGnnaop.exe
  2⤵
  PID:6936
- C:\Windows\System\jvNTQDX.exe
  C:\Windows\System\jvNTQDX.exe
  2⤵
  PID:6920
- C:\Windows\System\VgOszwV.exe
  C:\Windows\System\VgOszwV.exe
  2⤵
  PID:7068
- C:\Windows\System\cdKQuBD.exe
  C:\Windows\System\cdKQuBD.exe
  2⤵
  PID:7072
- C:\Windows\System\ZSkfrVM.exe
  C:\Windows\System\ZSkfrVM.exe
  2⤵
  PID:7164
- C:\Windows\System\OSbFxRc.exe
  C:\Windows\System\OSbFxRc.exe
  2⤵
  PID:7020
- C:\Windows\System\OthbKUy.exe
  C:\Windows\System\OthbKUy.exe
  2⤵
  PID:6396
- C:\Windows\System\RWtgKXK.exe
  C:\Windows\System\RWtgKXK.exe
  2⤵
  PID:6476
- C:\Windows\System\VLojgZB.exe
  C:\Windows\System\VLojgZB.exe
  2⤵
  PID:6652
- C:\Windows\System\yqxDxBF.exe
  C:\Windows\System\yqxDxBF.exe
  2⤵
  PID:6348
- C:\Windows\System\ciSDOuo.exe
  C:\Windows\System\ciSDOuo.exe
  2⤵
  PID:6812
- C:\Windows\System\zsQxpZK.exe
  C:\Windows\System\zsQxpZK.exe
  2⤵
  PID:6888
- C:\Windows\System\QWDkBNB.exe
  C:\Windows\System\QWDkBNB.exe
  2⤵
  PID:6792
- C:\Windows\System\wkPMYqe.exe
  C:\Windows\System\wkPMYqe.exe
  2⤵
  PID:6156
- C:\Windows\System\qosYozx.exe
  C:\Windows\System\qosYozx.exe
  2⤵
  PID:7104
- C:\Windows\System\BEWfGIE.exe
  C:\Windows\System\BEWfGIE.exe
  2⤵
  PID:6956
- C:\Windows\System\cvUsWHZ.exe
  C:\Windows\System\cvUsWHZ.exe
  2⤵
  PID:6392
- C:\Windows\System\GIsDwLV.exe
  C:\Windows\System\GIsDwLV.exe
  2⤵
  PID:6924
- C:\Windows\System\cxgTlpe.exe
  C:\Windows\System\cxgTlpe.exe
  2⤵
  PID:6188
- C:\Windows\System\KpokdAq.exe
  C:\Windows\System\KpokdAq.exe
  2⤵
  PID:6572
- C:\Windows\System\FPrPqFX.exe
  C:\Windows\System\FPrPqFX.exe
  2⤵
  PID:7180
- C:\Windows\System\RwJtLfG.exe
  C:\Windows\System\RwJtLfG.exe
  2⤵
  PID:7196
- C:\Windows\System\jMPomwJ.exe
  C:\Windows\System\jMPomwJ.exe
  2⤵
  PID:7212
- C:\Windows\System\vIpZZSZ.exe
  C:\Windows\System\vIpZZSZ.exe
  2⤵
  PID:7228
- C:\Windows\System\okUbVUV.exe
  C:\Windows\System\okUbVUV.exe
  2⤵
  PID:7244
- C:\Windows\System\BBPFgTX.exe
  C:\Windows\System\BBPFgTX.exe
  2⤵
  PID:7260
- C:\Windows\System\ooKkFvu.exe
  C:\Windows\System\ooKkFvu.exe
  2⤵
  PID:7276
- C:\Windows\System\pZDxEbS.exe
  C:\Windows\System\pZDxEbS.exe
  2⤵
  PID:7292
- C:\Windows\System\xEDJuef.exe
  C:\Windows\System\xEDJuef.exe
  2⤵
  PID:7308
- C:\Windows\System\jiQNXRt.exe
  C:\Windows\System\jiQNXRt.exe
  2⤵
  PID:7324
- C:\Windows\System\wHLODRo.exe
  C:\Windows\System\wHLODRo.exe
  2⤵
  PID:7340
- C:\Windows\System\RjmEUfU.exe
  C:\Windows\System\RjmEUfU.exe
  2⤵
  PID:7356
- C:\Windows\System\EPgOJrV.exe
  C:\Windows\System\EPgOJrV.exe
  2⤵
  PID:7372
- C:\Windows\System\Bsbjmtw.exe
  C:\Windows\System\Bsbjmtw.exe
  2⤵
  PID:7388
- C:\Windows\System\CJMiVba.exe
  C:\Windows\System\CJMiVba.exe
  2⤵
  PID:7404
- C:\Windows\System\fwVSSJP.exe
  C:\Windows\System\fwVSSJP.exe
  2⤵
  PID:7420
- C:\Windows\System\QffeqAB.exe
  C:\Windows\System\QffeqAB.exe
  2⤵
  PID:7436
- C:\Windows\System\apBhdyX.exe
  C:\Windows\System\apBhdyX.exe
  2⤵
  PID:7452
- C:\Windows\System\sIsENVK.exe
  C:\Windows\System\sIsENVK.exe
  2⤵
  PID:7468
- C:\Windows\System\wTGYrmv.exe
  C:\Windows\System\wTGYrmv.exe
  2⤵
  PID:7484
- C:\Windows\System\xpYmNwy.exe
  C:\Windows\System\xpYmNwy.exe
  2⤵
  PID:7500
- C:\Windows\System\LLZbZzh.exe
  C:\Windows\System\LLZbZzh.exe
  2⤵
  PID:7516
- C:\Windows\System\rZPDTky.exe
  C:\Windows\System\rZPDTky.exe
  2⤵
  PID:7532
- C:\Windows\System\ZOTMSfs.exe
  C:\Windows\System\ZOTMSfs.exe
  2⤵
  PID:7548
- C:\Windows\System\vKFPULW.exe
  C:\Windows\System\vKFPULW.exe
  2⤵
  PID:7564
- C:\Windows\System\wWjcpGS.exe
  C:\Windows\System\wWjcpGS.exe
  2⤵
  PID:7580
- C:\Windows\System\NJlMhDM.exe
  C:\Windows\System\NJlMhDM.exe
  2⤵
  PID:7596
- C:\Windows\System\hJmbzQx.exe
  C:\Windows\System\hJmbzQx.exe
  2⤵
  PID:7612
- C:\Windows\System\LaQkQbk.exe
  C:\Windows\System\LaQkQbk.exe
  2⤵
  PID:7628
- C:\Windows\System\TUmiZtU.exe
  C:\Windows\System\TUmiZtU.exe
  2⤵
  PID:7644
- C:\Windows\System\lUxuHWY.exe
  C:\Windows\System\lUxuHWY.exe
  2⤵
  PID:7660
- C:\Windows\System\gLRELyJ.exe
  C:\Windows\System\gLRELyJ.exe
  2⤵
  PID:7676
- C:\Windows\System\xLZuaNY.exe
  C:\Windows\System\xLZuaNY.exe
  2⤵
  PID:7692
- C:\Windows\System\cutMkeQ.exe
  C:\Windows\System\cutMkeQ.exe
  2⤵
  PID:7708
- C:\Windows\System\GpxvXlm.exe
  C:\Windows\System\GpxvXlm.exe
  2⤵
  PID:7724
- C:\Windows\System\GYXOpGp.exe
  C:\Windows\System\GYXOpGp.exe
  2⤵
  PID:7740
- C:\Windows\System\ofQzOHf.exe
  C:\Windows\System\ofQzOHf.exe
  2⤵
  PID:7756
- C:\Windows\System\JTwizcG.exe
  C:\Windows\System\JTwizcG.exe
  2⤵
  PID:7772
- C:\Windows\System\LxGMvgl.exe
  C:\Windows\System\LxGMvgl.exe
  2⤵
  PID:7788
- C:\Windows\System\SvjMHAv.exe
  C:\Windows\System\SvjMHAv.exe
  2⤵
  PID:7804
- C:\Windows\System\dMQldwo.exe
  C:\Windows\System\dMQldwo.exe
  2⤵
  PID:7820
- C:\Windows\System\NchTVCb.exe
  C:\Windows\System\NchTVCb.exe
  2⤵
  PID:7836
- C:\Windows\System\kPVdkxJ.exe
  C:\Windows\System\kPVdkxJ.exe
  2⤵
  PID:7852
- C:\Windows\System\LoZUPgs.exe
  C:\Windows\System\LoZUPgs.exe
  2⤵
  PID:7868
- C:\Windows\System\JkKxkSb.exe
  C:\Windows\System\JkKxkSb.exe
  2⤵
  PID:7884
- C:\Windows\System\CwSKuJx.exe
  C:\Windows\System\CwSKuJx.exe
  2⤵
  PID:7900
- C:\Windows\System\gUOwguy.exe
  C:\Windows\System\gUOwguy.exe
  2⤵
  PID:7916
- C:\Windows\System\LBTjyrU.exe
  C:\Windows\System\LBTjyrU.exe
  2⤵
  PID:7932
- C:\Windows\System\piuvSYB.exe
  C:\Windows\System\piuvSYB.exe
  2⤵
  PID:7948
- C:\Windows\System\ZAwnZMK.exe
  C:\Windows\System\ZAwnZMK.exe
  2⤵
  PID:7964
- C:\Windows\System\eMGiIHA.exe
  C:\Windows\System\eMGiIHA.exe
  2⤵
  PID:7980
- C:\Windows\System\qyQoyvB.exe
  C:\Windows\System\qyQoyvB.exe
  2⤵
  PID:7996
- C:\Windows\System\BlTlhZE.exe
  C:\Windows\System\BlTlhZE.exe
  2⤵
  PID:8012
- C:\Windows\System\gyoHkcb.exe
  C:\Windows\System\gyoHkcb.exe
  2⤵
  PID:8028
- C:\Windows\System\YVkQOOD.exe
  C:\Windows\System\YVkQOOD.exe
  2⤵
  PID:8044
- C:\Windows\System\AwUdpST.exe
  C:\Windows\System\AwUdpST.exe
  2⤵
  PID:8060
- C:\Windows\System\niPXHTF.exe
  C:\Windows\System\niPXHTF.exe
  2⤵
  PID:8076
- C:\Windows\System\QUaWECf.exe
  C:\Windows\System\QUaWECf.exe
  2⤵
  PID:8092
- C:\Windows\System\LbVzbhh.exe
  C:\Windows\System\LbVzbhh.exe
  2⤵
  PID:8112
- C:\Windows\System\DAyyatN.exe
  C:\Windows\System\DAyyatN.exe
  2⤵
  PID:8128
- C:\Windows\System\CiipYzw.exe
  C:\Windows\System\CiipYzw.exe
  2⤵
  PID:8144
- C:\Windows\System\BwkCZME.exe
  C:\Windows\System\BwkCZME.exe
  2⤵
  PID:8160
- C:\Windows\System\ekNsjcm.exe
  C:\Windows\System\ekNsjcm.exe
  2⤵
  PID:8176
- C:\Windows\System\ihbhzUY.exe
  C:\Windows\System\ihbhzUY.exe
  2⤵
  PID:7116
- C:\Windows\System\FGxFFdm.exe
  C:\Windows\System\FGxFFdm.exe
  2⤵
  PID:7224
- C:\Windows\System\ounBVrs.exe
  C:\Windows\System\ounBVrs.exe
  2⤵
  PID:7256
- C:\Windows\System\FbQWhdH.exe
  C:\Windows\System\FbQWhdH.exe
  2⤵
  PID:6604
- C:\Windows\System\CthUxPL.exe
  C:\Windows\System\CthUxPL.exe
  2⤵
  PID:7284
- C:\Windows\System\oGkLkOk.exe
  C:\Windows\System\oGkLkOk.exe
  2⤵
  PID:7320
- C:\Windows\System\UOSSjjj.exe
  C:\Windows\System\UOSSjjj.exe
  2⤵
  PID:7384
- C:\Windows\System\jserQMW.exe
  C:\Windows\System\jserQMW.exe
  2⤵
  PID:7448
- C:\Windows\System\IJXiyBe.exe
  C:\Windows\System\IJXiyBe.exe
  2⤵
  PID:7524
- C:\Windows\System\FCmMXIR.exe
  C:\Windows\System\FCmMXIR.exe
  2⤵
  PID:7460
- C:\Windows\System\ANSFvvA.exe
  C:\Windows\System\ANSFvvA.exe
  2⤵
  PID:7332
- C:\Windows\System\oBqEXiI.exe
  C:\Windows\System\oBqEXiI.exe
  2⤵
  PID:7368
- C:\Windows\System\IgiUANq.exe
  C:\Windows\System\IgiUANq.exe
  2⤵
  PID:7576
- C:\Windows\System\FyXAcYQ.exe
  C:\Windows\System\FyXAcYQ.exe
  2⤵
  PID:7636
- C:\Windows\System\XBvQbsP.exe
  C:\Windows\System\XBvQbsP.exe
  2⤵
  PID:7528
- C:\Windows\System\wqIbfMA.exe
  C:\Windows\System\wqIbfMA.exe
  2⤵
  PID:7732
- C:\Windows\System\ILcbdob.exe
  C:\Windows\System\ILcbdob.exe
  2⤵
  PID:7592
- C:\Windows\System\MJiWbms.exe
  C:\Windows\System\MJiWbms.exe
  2⤵
  PID:7336
- C:\Windows\System\zCwlbpE.exe
  C:\Windows\System\zCwlbpE.exe
  2⤵
  PID:7800
- C:\Windows\System\ivgiXhF.exe
  C:\Windows\System\ivgiXhF.exe
  2⤵
  PID:7752
- C:\Windows\System\rTUzTWy.exe
  C:\Windows\System\rTUzTWy.exe
  2⤵
  PID:7560
- C:\Windows\System\zaYDIVE.exe
  C:\Windows\System\zaYDIVE.exe
  2⤵
  PID:7816
- C:\Windows\System\qViImpd.exe
  C:\Windows\System\qViImpd.exe
  2⤵
  PID:7688
- C:\Windows\System\UYqGOMY.exe
  C:\Windows\System\UYqGOMY.exe
  2⤵
  PID:7716
- C:\Windows\System\isnXPPu.exe
  C:\Windows\System\isnXPPu.exe
  2⤵
  PID:7924
- C:\Windows\System\AKRwunb.exe
  C:\Windows\System\AKRwunb.exe
  2⤵
  PID:7908
- C:\Windows\System\Injtycx.exe
  C:\Windows\System\Injtycx.exe
  2⤵
  PID:7944
- C:\Windows\System\WXXkNJq.exe
  C:\Windows\System\WXXkNJq.exe
  2⤵
  PID:7972
- C:\Windows\System\rEjPRcE.exe
  C:\Windows\System\rEjPRcE.exe
  2⤵
  PID:8036
- C:\Windows\System\dSeIaFl.exe
  C:\Windows\System\dSeIaFl.exe
  2⤵
  PID:8084
- C:\Windows\System\hEJogID.exe
  C:\Windows\System\hEJogID.exe
  2⤵
  PID:8100
- C:\Windows\System\HFSYRnJ.exe
  C:\Windows\System\HFSYRnJ.exe
  2⤵
  PID:8152
- C:\Windows\System\pbmqAeO.exe
  C:\Windows\System\pbmqAeO.exe
  2⤵
  PID:8140
- C:\Windows\System\aljcPQF.exe
  C:\Windows\System\aljcPQF.exe
  2⤵
  PID:8188
- C:\Windows\System\VvlFpGd.exe
  C:\Windows\System\VvlFpGd.exe
  2⤵
  PID:7172
- C:\Windows\System\bgxklbP.exe
  C:\Windows\System\bgxklbP.exe
  2⤵
  PID:7352
- C:\Windows\System\AiyDdhr.exe
  C:\Windows\System\AiyDdhr.exe
  2⤵
  PID:7512
- C:\Windows\System\OxyJLtt.exe
  C:\Windows\System\OxyJLtt.exe
  2⤵
  PID:7316
- C:\Windows\System\VqwhQAM.exe
  C:\Windows\System\VqwhQAM.exe
  2⤵
  PID:7416
- C:\Windows\System\MBsVUqA.exe
  C:\Windows\System\MBsVUqA.exe
  2⤵
  PID:7400
- C:\Windows\System\RtAkdUM.exe
  C:\Windows\System\RtAkdUM.exe
  2⤵
  PID:7672
- C:\Windows\System\XLaDOnS.exe
  C:\Windows\System\XLaDOnS.exe
  2⤵
  PID:6944
- C:\Windows\System\GQbTePj.exe
  C:\Windows\System\GQbTePj.exe
  2⤵
  PID:7796
- C:\Windows\System\JvhUtWv.exe
  C:\Windows\System\JvhUtWv.exe
  2⤵
  PID:7844
- C:\Windows\System\TOdltJd.exe
  C:\Windows\System\TOdltJd.exe
  2⤵
  PID:7992
- C:\Windows\System\qkxusJf.exe
  C:\Windows\System\qkxusJf.exe
  2⤵
  PID:8068
- C:\Windows\System\ihWmSBw.exe
  C:\Windows\System\ihWmSBw.exe
  2⤵
  PID:8168
- C:\Windows\System\rOytWlY.exe
  C:\Windows\System\rOytWlY.exe
  2⤵
  PID:7496
- C:\Windows\System\aLVazKv.exe
  C:\Windows\System\aLVazKv.exe
  2⤵
  PID:7832
- C:\Windows\System\lyqMpui.exe
  C:\Windows\System\lyqMpui.exe
  2⤵
  PID:7784
- C:\Windows\System\nowQerR.exe
  C:\Windows\System\nowQerR.exe
  2⤵
  PID:7668
- C:\Windows\System\TaVjxkr.exe
  C:\Windows\System\TaVjxkr.exe
  2⤵
  PID:7204
- C:\Windows\System\rTymBAg.exe
  C:\Windows\System\rTymBAg.exe
  2⤵
  PID:8020
- C:\Windows\System\sphXmWB.exe
  C:\Windows\System\sphXmWB.exe
  2⤵
  PID:7720
- C:\Windows\System\QfqdPKh.exe
  C:\Windows\System\QfqdPKh.exe
  2⤵
  PID:7848
- C:\Windows\System\KTCgkyQ.exe
  C:\Windows\System\KTCgkyQ.exe
  2⤵
  PID:8124
- C:\Windows\System\AjnwbcW.exe
  C:\Windows\System\AjnwbcW.exe
  2⤵
  PID:8120
- C:\Windows\System\fCGXxky.exe
  C:\Windows\System\fCGXxky.exe
  2⤵
  PID:8024
- C:\Windows\System\MTFuTCr.exe
  C:\Windows\System\MTFuTCr.exe
  2⤵
  PID:7748
- C:\Windows\System\IbALkjd.exe
  C:\Windows\System\IbALkjd.exe
  2⤵
  PID:7956
- C:\Windows\System\iZMGyhy.exe
  C:\Windows\System\iZMGyhy.exe
  2⤵
  PID:7428
- C:\Windows\System\fwPJyUO.exe
  C:\Windows\System\fwPJyUO.exe
  2⤵
  PID:8172
- C:\Windows\System\uVCbMYM.exe
  C:\Windows\System\uVCbMYM.exe
  2⤵
  PID:7876
- C:\Windows\System\jCGiKDs.exe
  C:\Windows\System\jCGiKDs.exe
  2⤵
  PID:8208
- C:\Windows\System\wQyJDsg.exe
  C:\Windows\System\wQyJDsg.exe
  2⤵
  PID:8224
- C:\Windows\System\LuIgjQo.exe
  C:\Windows\System\LuIgjQo.exe
  2⤵
  PID:8240
- C:\Windows\System\KGagUDQ.exe
  C:\Windows\System\KGagUDQ.exe
  2⤵
  PID:8256
- C:\Windows\System\ULghLEg.exe
  C:\Windows\System\ULghLEg.exe
  2⤵
  PID:8272
- C:\Windows\System\CjjcVzJ.exe
  C:\Windows\System\CjjcVzJ.exe
  2⤵
  PID:8288
- C:\Windows\System\GzBfksq.exe
  C:\Windows\System\GzBfksq.exe
  2⤵
  PID:8304
- C:\Windows\System\QbrGyqo.exe
  C:\Windows\System\QbrGyqo.exe
  2⤵
  PID:8320
- C:\Windows\System\ZfpdAaf.exe
  C:\Windows\System\ZfpdAaf.exe
  2⤵
  PID:8336
- C:\Windows\System\LfYrFbA.exe
  C:\Windows\System\LfYrFbA.exe
  2⤵
  PID:8352
- C:\Windows\System\FuodzwX.exe
  C:\Windows\System\FuodzwX.exe
  2⤵
  PID:8368
- C:\Windows\System\hRAdpRp.exe
  C:\Windows\System\hRAdpRp.exe
  2⤵
  PID:8384
- C:\Windows\System\VneAOOY.exe
  C:\Windows\System\VneAOOY.exe
  2⤵
  PID:8400
- C:\Windows\System\xNXCcBB.exe
  C:\Windows\System\xNXCcBB.exe
  2⤵
  PID:8416
- C:\Windows\System\FsSNsFJ.exe
  C:\Windows\System\FsSNsFJ.exe
  2⤵
  PID:8432
- C:\Windows\System\RHCjsSG.exe
  C:\Windows\System\RHCjsSG.exe
  2⤵
  PID:8448
- C:\Windows\System\GddjBtT.exe
  C:\Windows\System\GddjBtT.exe
  2⤵
  PID:8464
- C:\Windows\System\VFcrtjV.exe
  C:\Windows\System\VFcrtjV.exe
  2⤵
  PID:8480
- C:\Windows\System\tPLhHYv.exe
  C:\Windows\System\tPLhHYv.exe
  2⤵
  PID:8496
- C:\Windows\System\uBWErYK.exe
  C:\Windows\System\uBWErYK.exe
  2⤵
  PID:8512
- C:\Windows\System\RiKtnEg.exe
  C:\Windows\System\RiKtnEg.exe
  2⤵
  PID:8528
- C:\Windows\System\rFZoNBJ.exe
  C:\Windows\System\rFZoNBJ.exe
  2⤵
  PID:8544
- C:\Windows\System\DKBmQeY.exe
  C:\Windows\System\DKBmQeY.exe
  2⤵
  PID:8560
- C:\Windows\System\ORkXfbO.exe
  C:\Windows\System\ORkXfbO.exe
  2⤵
  PID:8576
- C:\Windows\System\sRmgidI.exe
  C:\Windows\System\sRmgidI.exe
  2⤵
  PID:8592
- C:\Windows\System\ZUWrZTe.exe
  C:\Windows\System\ZUWrZTe.exe
  2⤵
  PID:8608
- C:\Windows\System\jizMjBI.exe
  C:\Windows\System\jizMjBI.exe
  2⤵
  PID:8624
- C:\Windows\System\sUqGdit.exe
  C:\Windows\System\sUqGdit.exe
  2⤵
  PID:8640
- C:\Windows\System\BZrhEyY.exe
  C:\Windows\System\BZrhEyY.exe
  2⤵
  PID:8656
- C:\Windows\System\rnuAaYz.exe
  C:\Windows\System\rnuAaYz.exe
  2⤵
  PID:8672
- C:\Windows\System\CefUlgL.exe
  C:\Windows\System\CefUlgL.exe
  2⤵
  PID:8688
- C:\Windows\System\ERrTLuf.exe
  C:\Windows\System\ERrTLuf.exe
  2⤵
  PID:8704
- C:\Windows\System\nMMlJsM.exe
  C:\Windows\System\nMMlJsM.exe
  2⤵
  PID:8720
- C:\Windows\System\JdzAeCh.exe
  C:\Windows\System\JdzAeCh.exe
  2⤵
  PID:8736
- C:\Windows\System\wnccyLV.exe
  C:\Windows\System\wnccyLV.exe
  2⤵
  PID:8752
- C:\Windows\System\AriefqV.exe
  C:\Windows\System\AriefqV.exe
  2⤵
  PID:8768
- C:\Windows\System\cdQmrPJ.exe
  C:\Windows\System\cdQmrPJ.exe
  2⤵
  PID:8784
- C:\Windows\System\CxXWBBZ.exe
  C:\Windows\System\CxXWBBZ.exe
  2⤵
  PID:8800
- C:\Windows\System\OpRWyrq.exe
  C:\Windows\System\OpRWyrq.exe
  2⤵
  PID:8816
- C:\Windows\System\OZWpkCW.exe
  C:\Windows\System\OZWpkCW.exe
  2⤵
  PID:8832
- C:\Windows\System\YniZSIs.exe
  C:\Windows\System\YniZSIs.exe
  2⤵
  PID:8848
- C:\Windows\System\nxYtVwX.exe
  C:\Windows\System\nxYtVwX.exe
  2⤵
  PID:8864
- C:\Windows\System\HnnzGNU.exe
  C:\Windows\System\HnnzGNU.exe
  2⤵
  PID:8880
- C:\Windows\System\KuiDczd.exe
  C:\Windows\System\KuiDczd.exe
  2⤵
  PID:8896
- C:\Windows\System\KzGtChW.exe
  C:\Windows\System\KzGtChW.exe
  2⤵
  PID:8912
- C:\Windows\System\UWIUSFe.exe
  C:\Windows\System\UWIUSFe.exe
  2⤵
  PID:8928
- C:\Windows\System\tzzrNoN.exe
  C:\Windows\System\tzzrNoN.exe
  2⤵
  PID:8944
- C:\Windows\System\EALDehM.exe
  C:\Windows\System\EALDehM.exe
  2⤵
  PID:8960
- C:\Windows\System\UPHVtVl.exe
  C:\Windows\System\UPHVtVl.exe
  2⤵
  PID:8976
- C:\Windows\System\ckCcRSt.exe
  C:\Windows\System\ckCcRSt.exe
  2⤵
  PID:8992
- C:\Windows\System\PiUoSDq.exe
  C:\Windows\System\PiUoSDq.exe
  2⤵
  PID:9008
- C:\Windows\System\smNghOL.exe
  C:\Windows\System\smNghOL.exe
  2⤵
  PID:9024
- C:\Windows\System\NKyVWJe.exe
  C:\Windows\System\NKyVWJe.exe
  2⤵
  PID:9040
- C:\Windows\System\eBBxzBz.exe
  C:\Windows\System\eBBxzBz.exe
  2⤵
  PID:9056
- C:\Windows\System\booFdQo.exe
  C:\Windows\System\booFdQo.exe
  2⤵
  PID:9072
- C:\Windows\System\YtuVlfX.exe
  C:\Windows\System\YtuVlfX.exe
  2⤵
  PID:9088
- C:\Windows\System\AzbFyEj.exe
  C:\Windows\System\AzbFyEj.exe
  2⤵
  PID:9104
- C:\Windows\System\uxfwhjP.exe
  C:\Windows\System\uxfwhjP.exe
  2⤵
  PID:9120
- C:\Windows\System\pfMiZnc.exe
  C:\Windows\System\pfMiZnc.exe
  2⤵
  PID:9136
- C:\Windows\System\vJAbefh.exe
  C:\Windows\System\vJAbefh.exe
  2⤵
  PID:9152
- C:\Windows\System\rwNalyt.exe
  C:\Windows\System\rwNalyt.exe
  2⤵
  PID:9168
- C:\Windows\System\muUIsIP.exe
  C:\Windows\System\muUIsIP.exe
  2⤵
  PID:9184
- C:\Windows\System\owpFPRR.exe
  C:\Windows\System\owpFPRR.exe
  2⤵
  PID:9200
- C:\Windows\System\HaygLPB.exe
  C:\Windows\System\HaygLPB.exe
  2⤵
  PID:7940
- C:\Windows\System\zLAXTzl.exe
  C:\Windows\System\zLAXTzl.exe
  2⤵
  PID:8052
- C:\Windows\System\eWWRTFS.exe
  C:\Windows\System\eWWRTFS.exe
  2⤵
  PID:8200
- C:\Windows\System\ebusEpP.exe
  C:\Windows\System\ebusEpP.exe
  2⤵
  PID:8252
- C:\Windows\System\TGsiZLS.exe
  C:\Windows\System\TGsiZLS.exe
  2⤵
  PID:8232
- C:\Windows\System\AUtCouW.exe
  C:\Windows\System\AUtCouW.exe
  2⤵
  PID:8316
- C:\Windows\System\TCTmQdz.exe
  C:\Windows\System\TCTmQdz.exe
  2⤵
  PID:8348
- C:\Windows\System\sfeDFuF.exe
  C:\Windows\System\sfeDFuF.exe
  2⤵
  PID:8332
- C:\Windows\System\KJOXsfE.exe
  C:\Windows\System\KJOXsfE.exe
  2⤵
  PID:8360
- C:\Windows\System\zspMVdP.exe
  C:\Windows\System\zspMVdP.exe
  2⤵
  PID:8444
- C:\Windows\System\xtFXNhZ.exe
  C:\Windows\System\xtFXNhZ.exe
  2⤵
  PID:8508
- C:\Windows\System\TmXkXkl.exe
  C:\Windows\System\TmXkXkl.exe
  2⤵
  PID:8460
- C:\Windows\System\tBjQzAM.exe
  C:\Windows\System\tBjQzAM.exe
  2⤵
  PID:8520
- C:\Windows\System\gmdOVoo.exe
  C:\Windows\System\gmdOVoo.exe
  2⤵
  PID:8572
- C:\Windows\System\nOLWmpw.exe
  C:\Windows\System\nOLWmpw.exe
  2⤵
  PID:8556
- C:\Windows\System\oIhKOWo.exe
  C:\Windows\System\oIhKOWo.exe
  2⤵
  PID:8620
- C:\Windows\System\lKyPvat.exe
  C:\Windows\System\lKyPvat.exe
  2⤵
  PID:8648
- C:\Windows\System\DMpLZPV.exe
  C:\Windows\System\DMpLZPV.exe
  2⤵
  PID:8680
- C:\Windows\System\gRTztfi.exe
  C:\Windows\System\gRTztfi.exe
  2⤵
  PID:8716
- C:\Windows\System\vmWdaAB.exe
  C:\Windows\System\vmWdaAB.exe
  2⤵
  PID:8764
- C:\Windows\System\JbRGEkj.exe
  C:\Windows\System\JbRGEkj.exe
  2⤵
  PID:8744
- C:\Windows\System\KqOCHOT.exe
  C:\Windows\System\KqOCHOT.exe
  2⤵
  PID:8824
- C:\Windows\System\pHHmTfJ.exe
  C:\Windows\System\pHHmTfJ.exe
  2⤵
  PID:8856
- C:\Windows\System\jwqeNUS.exe
  C:\Windows\System\jwqeNUS.exe
  2⤵
  PID:8872
- C:\Windows\System\fhVLKjO.exe
  C:\Windows\System\fhVLKjO.exe
  2⤵
  PID:8908
- C:\Windows\System\fNmmgTG.exe
  C:\Windows\System\fNmmgTG.exe
  2⤵
  PID:8956
- C:\Windows\System\kTCmgkw.exe
  C:\Windows\System\kTCmgkw.exe
  2⤵
  PID:8936
- C:\Windows\System\YLnVLyJ.exe
  C:\Windows\System\YLnVLyJ.exe
  2⤵
  PID:8972
- C:\Windows\System\WLZKtVM.exe
  C:\Windows\System\WLZKtVM.exe
  2⤵
  PID:9084
- C:\Windows\System\wQphaly.exe
  C:\Windows\System\wQphaly.exe
  2⤵
  PID:9064
- C:\Windows\System\YPrynhq.exe
  C:\Windows\System\YPrynhq.exe
  2⤵
  PID:9032
- C:\Windows\System\xYhMeUI.exe
  C:\Windows\System\xYhMeUI.exe
  2⤵
  PID:9132
- C:\Windows\System\QjmoyGw.exe
  C:\Windows\System\QjmoyGw.exe
  2⤵
  PID:9176
- C:\Windows\System\HapCDep.exe
  C:\Windows\System\HapCDep.exe
  2⤵
  PID:9212
- C:\Windows\System\ZSdOpTq.exe
  C:\Windows\System\ZSdOpTq.exe
  2⤵
  PID:7252
- C:\Windows\System\wqKdVsq.exe
  C:\Windows\System\wqKdVsq.exe
  2⤵
  PID:8220
- C:\Windows\System\rOiKSPW.exe
  C:\Windows\System\rOiKSPW.exe
  2⤵
  PID:8344
- C:\Windows\System\jKwNcvP.exe
  C:\Windows\System\jKwNcvP.exe
  2⤵
  PID:7508
- C:\Windows\System\WAmnbtj.exe
  C:\Windows\System\WAmnbtj.exe
  2⤵
  PID:8604
- C:\Windows\System\iYYkFCk.exe
  C:\Windows\System\iYYkFCk.exe
  2⤵
  PID:8636
- C:\Windows\System\ghCHQGh.exe
  C:\Windows\System\ghCHQGh.exe
  2⤵
  PID:8540
- C:\Windows\System\rLclyXf.exe
  C:\Windows\System\rLclyXf.exe
  2⤵
  PID:8364
- C:\Windows\System\UTdNdNx.exe
  C:\Windows\System\UTdNdNx.exe
  2⤵
  PID:8696
- C:\Windows\System\fntIdJC.exe
  C:\Windows\System\fntIdJC.exe
  2⤵
  PID:8780
- C:\Windows\System\lGsmTlV.exe
  C:\Windows\System\lGsmTlV.exe
  2⤵
  PID:8828
- C:\Windows\System\RpKEuHc.exe
  C:\Windows\System\RpKEuHc.exe
  2⤵
  PID:8904
- C:\Windows\System\ieJcKkk.exe
  C:\Windows\System\ieJcKkk.exe
  2⤵
  PID:9052
- C:\Windows\System\AQaMfHh.exe
  C:\Windows\System\AQaMfHh.exe
  2⤵
  PID:9112
- C:\Windows\System\umjCZKz.exe
  C:\Windows\System\umjCZKz.exe
  2⤵
  PID:9116
- C:\Windows\System\lHDpCZQ.exe
  C:\Windows\System\lHDpCZQ.exe
  2⤵
  PID:9148
- C:\Windows\System\xQsVZyU.exe
  C:\Windows\System\xQsVZyU.exe
  2⤵
  PID:9164
- C:\Windows\System\ezAFbfb.exe
  C:\Windows\System\ezAFbfb.exe
  2⤵
  PID:8268
- C:\Windows\System\tACRkSH.exe
  C:\Windows\System\tACRkSH.exe
  2⤵
  PID:8536
- C:\Windows\System\EmBhVvt.exe
  C:\Windows\System\EmBhVvt.exe
  2⤵
  PID:8664
- C:\Windows\System\XPLSYIm.exe
  C:\Windows\System\XPLSYIm.exe
  2⤵
  PID:8700
- C:\Windows\System\YezqtyB.exe
  C:\Windows\System\YezqtyB.exe
  2⤵
  PID:8652
- C:\Windows\System\ZPbWOSS.exe
  C:\Windows\System\ZPbWOSS.exe
  2⤵
  PID:8892
- C:\Windows\System\VjBNWCV.exe
  C:\Windows\System\VjBNWCV.exe
  2⤵
  PID:8924
- C:\Windows\System\RZXOhGq.exe
  C:\Windows\System\RZXOhGq.exe
  2⤵
  PID:9160
- C:\Windows\System\kkPWRht.exe
  C:\Windows\System\kkPWRht.exe
  2⤵
  PID:8396
- C:\Windows\System\BFgjCFI.exe
  C:\Windows\System\BFgjCFI.exe
  2⤵
  PID:8204
- C:\Windows\System\nWFupNW.exe
  C:\Windows\System\nWFupNW.exe
  2⤵
  PID:8616
- C:\Windows\System\oALfOpo.exe
  C:\Windows\System\oALfOpo.exe
  2⤵
  PID:9128
- C:\Windows\System\DLTsIXX.exe
  C:\Windows\System\DLTsIXX.exe
  2⤵
  PID:9232
- C:\Windows\System\CcJkoJV.exe
  C:\Windows\System\CcJkoJV.exe
  2⤵
  PID:9248
- C:\Windows\System\XutXtbj.exe
  C:\Windows\System\XutXtbj.exe
  2⤵
  PID:9264
- C:\Windows\System\CKRYJei.exe
  C:\Windows\System\CKRYJei.exe
  2⤵
  PID:9280
- C:\Windows\System\mQKfZVa.exe
  C:\Windows\System\mQKfZVa.exe
  2⤵
  PID:9296
- C:\Windows\System\XgbVrJT.exe
  C:\Windows\System\XgbVrJT.exe
  2⤵
  PID:9312
- C:\Windows\System\WldQlyQ.exe
  C:\Windows\System\WldQlyQ.exe
  2⤵
  PID:9328
- C:\Windows\System\umRyGVC.exe
  C:\Windows\System\umRyGVC.exe
  2⤵
  PID:9344
- C:\Windows\System\qVqafiD.exe
  C:\Windows\System\qVqafiD.exe
  2⤵
  PID:9360
- C:\Windows\System\VHbNgHM.exe
  C:\Windows\System\VHbNgHM.exe
  2⤵
  PID:9376
- C:\Windows\System\TENhTQt.exe
  C:\Windows\System\TENhTQt.exe
  2⤵
  PID:9392
- C:\Windows\System\KIuLuwc.exe
  C:\Windows\System\KIuLuwc.exe
  2⤵
  PID:9408
- C:\Windows\System\uiZoxtT.exe
  C:\Windows\System\uiZoxtT.exe
  2⤵
  PID:9424
- C:\Windows\System\jbpPHgh.exe
  C:\Windows\System\jbpPHgh.exe
  2⤵
  PID:9440
- C:\Windows\System\bKZBKRI.exe
  C:\Windows\System\bKZBKRI.exe
  2⤵
  PID:10220
- C:\Windows\System\dMJLwmc.exe
  C:\Windows\System\dMJLwmc.exe
  2⤵
  PID:8412
- C:\Windows\System\KXECogx.exe
  C:\Windows\System\KXECogx.exe
  2⤵
  PID:8968
- C:\Windows\System\bNRBRFo.exe
  C:\Windows\System\bNRBRFo.exe
  2⤵
  PID:9272
- C:\Windows\System\cRGCKOF.exe
  C:\Windows\System\cRGCKOF.exe
  2⤵
  PID:9732
- C:\Windows\System\nQnbrjR.exe
  C:\Windows\System\nQnbrjR.exe
  2⤵
  PID:9756
- C:\Windows\System\jdXndvE.exe
  C:\Windows\System\jdXndvE.exe
  2⤵
  PID:9752
- C:\Windows\System\vEXYGJG.exe
  C:\Windows\System\vEXYGJG.exe
  2⤵
  PID:9784
- C:\Windows\System\oWYdvGG.exe
  C:\Windows\System\oWYdvGG.exe
  2⤵
  PID:9808
- C:\Windows\System\wpAeQLU.exe
  C:\Windows\System\wpAeQLU.exe
  2⤵
  PID:9844
- C:\Windows\System\GZPdsum.exe
  C:\Windows\System\GZPdsum.exe
  2⤵
  PID:9824
- C:\Windows\System\ldEpxCz.exe
  C:\Windows\System\ldEpxCz.exe
  2⤵
  PID:9848
- C:\Windows\System\ZIKoONT.exe
  C:\Windows\System\ZIKoONT.exe
  2⤵
  PID:9864
- C:\Windows\System\lsKNRBg.exe
  C:\Windows\System\lsKNRBg.exe
  2⤵
  PID:9880
- C:\Windows\System\tRCAPhe.exe
  C:\Windows\System\tRCAPhe.exe
  2⤵
  PID:9896
- C:\Windows\System\whdqmJd.exe
  C:\Windows\System\whdqmJd.exe
  2⤵
  PID:9912
- C:\Windows\System\RYdVsWA.exe
  C:\Windows\System\RYdVsWA.exe
  2⤵
  PID:9928
- C:\Windows\System\innPiWh.exe
  C:\Windows\System\innPiWh.exe
  2⤵
  PID:9944
- C:\Windows\System\EEvvkIa.exe
  C:\Windows\System\EEvvkIa.exe
  2⤵
  PID:9960
- C:\Windows\System\KCXOHAo.exe
  C:\Windows\System\KCXOHAo.exe
  2⤵
  PID:9976
- C:\Windows\System\WLPyZtN.exe
  C:\Windows\System\WLPyZtN.exe
  2⤵
  PID:9992
- C:\Windows\System\PSXEqhB.exe
  C:\Windows\System\PSXEqhB.exe
  2⤵
  PID:10008
- C:\Windows\System\VujIDbT.exe
  C:\Windows\System\VujIDbT.exe
  2⤵
  PID:10028
- C:\Windows\System\RPruyJJ.exe
  C:\Windows\System\RPruyJJ.exe
  2⤵
  PID:10040
- C:\Windows\System\DjTGjsu.exe
  C:\Windows\System\DjTGjsu.exe
  2⤵
  PID:10048
- C:\Windows\System\jDUZljq.exe
  C:\Windows\System\jDUZljq.exe
  2⤵
  PID:10084
- C:\Windows\System\wmCdWxR.exe
  C:\Windows\System\wmCdWxR.exe
  2⤵
  PID:10080
- C:\Windows\System\zmdOuqn.exe
  C:\Windows\System\zmdOuqn.exe
  2⤵
  PID:10108
- C:\Windows\System\luJJXfU.exe
  C:\Windows\System\luJJXfU.exe
  2⤵
  PID:10124
- C:\Windows\System\hAWcrzp.exe
  C:\Windows\System\hAWcrzp.exe
  2⤵
  PID:10140
- C:\Windows\System\JECvzUA.exe
  C:\Windows\System\JECvzUA.exe
  2⤵
  PID:10156
- C:\Windows\System\nqnVTXw.exe
  C:\Windows\System\nqnVTXw.exe
  2⤵
  PID:9856
- C:\Windows\System\ZiYcBzu.exe
  C:\Windows\System\ZiYcBzu.exe
  2⤵
  PID:10192
- C:\Windows\System\FOIuNdZ.exe
  C:\Windows\System\FOIuNdZ.exe
  2⤵
  PID:10232
- C:\Windows\System\igtcuYz.exe
  C:\Windows\System\igtcuYz.exe
  2⤵
  PID:9528
- C:\Windows\System\aOVrnru.exe
  C:\Windows\System\aOVrnru.exe
  2⤵
  PID:9696
- C:\Windows\System\wZYwzqp.exe
  C:\Windows\System\wZYwzqp.exe
  2⤵
  PID:2376
- C:\Windows\System\pyJndji.exe
  C:\Windows\System\pyJndji.exe
  2⤵
  PID:10092
- C:\Windows\System\WFnHjpZ.exe
  C:\Windows\System\WFnHjpZ.exe
  2⤵
  PID:9596
- C:\Windows\System\cEaBtzR.exe
  C:\Windows\System\cEaBtzR.exe
  2⤵
  PID:9324
- C:\Windows\System\UHHLstY.exe
  C:\Windows\System\UHHLstY.exe
  2⤵
  PID:9404
- C:\Windows\System\QeLVBJG.exe
  C:\Windows\System\QeLVBJG.exe
  2⤵
  PID:9564
- C:\Windows\System\kmNnOBM.exe
  C:\Windows\System\kmNnOBM.exe
  2⤵
  PID:9588
- C:\Windows\System\saPZicV.exe
  C:\Windows\System\saPZicV.exe
  2⤵
  PID:9648
- C:\Windows\System\VBPkXhk.exe
  C:\Windows\System\VBPkXhk.exe
  2⤵
  PID:9668
- C:\Windows\System\GIbVGtT.exe
  C:\Windows\System\GIbVGtT.exe
  2⤵
  PID:9684
- C:\Windows\System\fOUfEqe.exe
  C:\Windows\System\fOUfEqe.exe
  2⤵
  PID:9704
- C:\Windows\System\SYcrnDq.exe
  C:\Windows\System\SYcrnDq.exe
  2⤵
  PID:8712
- C:\Windows\System\kMmvvWy.exe
  C:\Windows\System\kMmvvWy.exe
  2⤵
  PID:2388
- C:\Windows\System\WDDNTFO.exe
  C:\Windows\System\WDDNTFO.exe
  2⤵
  PID:9748
- C:\Windows\System\mxmnuir.exe
  C:\Windows\System\mxmnuir.exe
  2⤵
  PID:9984
- C:\Windows\System\mDNJxVp.exe
  C:\Windows\System\mDNJxVp.exe
  2⤵
  PID:9908
- C:\Windows\System\pIfTjIz.exe
  C:\Windows\System\pIfTjIz.exe
  2⤵
  PID:9920
- C:\Windows\System\qpFQssU.exe
  C:\Windows\System\qpFQssU.exe
  2⤵
  PID:10032
- C:\Windows\System\byHvgMh.exe
  C:\Windows\System\byHvgMh.exe
  2⤵
  PID:9872
- C:\Windows\System\nkyXNDJ.exe
  C:\Windows\System\nkyXNDJ.exe
  2⤵
  PID:10104
- C:\Windows\System\QHrooVP.exe
  C:\Windows\System\QHrooVP.exe
  2⤵
  PID:10064
- C:\Windows\System\xuiPLxs.exe
  C:\Windows\System\xuiPLxs.exe
  2⤵
  PID:10052
- C:\Windows\System\qKzxehv.exe
  C:\Windows\System\qKzxehv.exe
  2⤵
  PID:8492
- C:\Windows\System\cWzVcWJ.exe
  C:\Windows\System\cWzVcWJ.exe
  2⤵
  PID:8888
- C:\Windows\System\vzdzCoF.exe
  C:\Windows\System\vzdzCoF.exe
  2⤵
  PID:8840
- C:\Windows\System\eHXqUsg.exe
  C:\Windows\System\eHXqUsg.exe
  2⤵
  PID:9420
- C:\Windows\System\mgBOHSu.exe
  C:\Windows\System\mgBOHSu.exe
  2⤵
  PID:9228
- C:\Windows\System\dLQGzRN.exe
  C:\Windows\System\dLQGzRN.exe
  2⤵
  PID:9632
- C:\Windows\System\HuIaPxZ.exe
  C:\Windows\System\HuIaPxZ.exe
  2⤵
  PID:9308
- C:\Windows\System\xbJJYPj.exe
  C:\Windows\System\xbJJYPj.exe
  2⤵
  PID:9372
- C:\Windows\System\LITeMzI.exe
  C:\Windows\System\LITeMzI.exe
  2⤵
  PID:9604
- C:\Windows\System\lZmJDnI.exe
  C:\Windows\System\lZmJDnI.exe
  2⤵
  PID:9336
- C:\Windows\System\vYrpcBH.exe
  C:\Windows\System\vYrpcBH.exe
  2⤵
  PID:9448
- C:\Windows\System\AaPyeRJ.exe
  C:\Windows\System\AaPyeRJ.exe
  2⤵
  PID:9600
- C:\Windows\System\bhPaGwY.exe
  C:\Windows\System\bhPaGwY.exe
  2⤵
  PID:9432
- C:\Windows\System\cTeGxuT.exe
  C:\Windows\System\cTeGxuT.exe
  2⤵
  PID:9720
- C:\Windows\System\znFWddx.exe
  C:\Windows\System\znFWddx.exe
  2⤵
  PID:9712
- C:\Windows\System\zUHwrqM.exe
  C:\Windows\System\zUHwrqM.exe
  2⤵
  PID:10016
- C:\Windows\System\ckHUPxA.exe
  C:\Windows\System\ckHUPxA.exe
  2⤵
  PID:9956
- C:\Windows\System\geZxTnf.exe
  C:\Windows\System\geZxTnf.exe
  2⤵
  PID:9972
- C:\Windows\System\LtmVZwV.exe
  C:\Windows\System\LtmVZwV.exe
  2⤵
  PID:10020
- C:\Windows\System\usWXSvu.exe
  C:\Windows\System\usWXSvu.exe
  2⤵
  PID:10076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BMXJmQT.exe

Filesize
1.2MB

MD5
fea4d918f656058c81d4b22facae9c93

SHA1
b1615a64195d172c60685faf8c4321acc829f239

SHA256
7cd670c3d34627afa0978a2a5d07514d6586b029b58112697f5b3d33a250aa3d

SHA512
cfe0e97ee74d94262e480334bad024d1a8e42182c198fdf2e54af1ab5019d85b4d6b860415ea768a3ace730f815bb3f176bdb6da9dccefeb023f626e12bfdbff

Download Submit
C:\Windows\system\FGxHetx.exe

Filesize
1.2MB

MD5
af069fcb567608c728b74ea990f1222c

SHA1
bc7fcb6c463dd3daeddeb1534d31a53bd7ec6cfc

SHA256
9c5fcfada80154c6d13a71c945887df39281d28d25c001d9bf9c0afaf6a9d3db

SHA512
318d17b552643627989461bd4e57c03be0875b510bcb56919751c2d0c358a4d62483593053ffbe279014ecc04a2cddbb2bdb0b8a6fde9a409caa423551d3e8ea

Download Submit
C:\Windows\system\KFlndpz.exe

Filesize
1.2MB

MD5
84a5adc0228b0fa066cfc4fd0df56ead

SHA1
8b5a53a8a14d09e8b341c17355b4491feedb8d10

SHA256
449c8e1d7811fb372da0ed78f0d68db5b8083f69bdfc31c81bcbf18d02acb0c2

SHA512
493a218b86947b491eadb9891cced2bccfc5d45f63b68cce1c9d71efd0cd49e66a07fdd16919314845157132b69388537098f4ef12c36df7b1293650926942d2

Download Submit
C:\Windows\system\KxuonCX.exe

Filesize
1.2MB

MD5
839d2fdfafb8bb4803a181a4fe0a2ba3

SHA1
265d4abdc91010e52fc9da608df04c2159219cc4

SHA256
1a9628e1fb0e8629761427d7383a1293929fe1ce373ad2bf5fdcd1e06f1d1d50

SHA512
2fb85d3f98b4684445ef8d583d3d06846394ad280797b7995bb32e89eea66265b051b2b7f45c9f49ebbf5540d56b8cade974df8cddbda7432c57e59512753513

Download Submit
C:\Windows\system\MdUuoTP.exe

Filesize
1.2MB

MD5
0800b24eff4436dfcc78fbb795772647

SHA1
360362c4c0ff138f3c2e58e2524cd19518f9639e

SHA256
12abe5be925df8b00d2eb9faddc40efdb92d9859e504c6d4a44bfc3d3d2dd7b0

SHA512
c149836e6b709625759414bbdfea754b32f27fb5e6fd00478fbe5aa0a0d9b7b4e3317c99e0fdd734edce18c9a2ff5e077416e742ca76c77142f2ca9e266315d2

Download Submit
C:\Windows\system\MgtIbTL.exe

Filesize
1.2MB

MD5
2ad2ebb6db3198208e562f4193199893

SHA1
f2d32099d2a7e595df8810c3252d57526dcdafec

SHA256
33e4dea398362f3f4c2e07243c6f4dc5e11377d05ef545ee43a6bed08f59c716

SHA512
ba700b8c75e61f1ecd15dc4a53594321657f57efa1c404026f5fa0f4e827c0ebaeacc1e68f29656752382e5fbe13fffea8c9b93df6e3e5d8fb2e5b924db56b6f

Download Submit
C:\Windows\system\NGrAtTY.exe

Filesize
1.2MB

MD5
9ae166739c52af0ad15214cd9d8adc51

SHA1
fde5b8bcd357ed0ec43d760009703814b9139d47

SHA256
3cf81cd591ecd0bff69a0d885cffa713e14b64b0df67106df7e510dff940762a

SHA512
75a5426735b5c13328fdc0e9cc7cfff5c2b93dd3b8458f9857a029698e904d338c2dd9ae37bedcc3d57fbd3b36e7517a2543c1c8d1bc0914f98f9181b88702f8

Download Submit
C:\Windows\system\PauhqEF.exe

Filesize
1.2MB

MD5
08b8b457549d4b5951bf0ac785468e5b

SHA1
6ba62ca4a8ee181755929a6b603249b6d35bc783

SHA256
694b3403bbecfbc10b945e56002793222efc7f1c84ea6f631e5bb54276f130cb

SHA512
14179613a9bb9aa0b878bfe7a49fe05b122abac6af3a911fdf33d1457980a869686a55c48eb3b97a8895919d90501f38e5d231bc0a273ec4b93edeb594b831fe

Download Submit
C:\Windows\system\RdjzihZ.exe

Filesize
1.2MB

MD5
86f089b81ff8b3457dc2cb6eb574bc87

SHA1
a784553b24a8a4841c48d4b541c0ef0343ca4814

SHA256
7e7e5b4c8ad59df55cb15300e6401f08bf8ee15e027fda723ba561eeb45277e9

SHA512
865093220d283f260ce1611a057745ee1a65600591cbbdeb28c09f0092aac8d40863fe3926beb7e3dc732db3b153efe4675231e4fc7f382ef878e0c594f6e923

Download Submit
C:\Windows\system\RvCzUoF.exe

Filesize
1.2MB

MD5
bdbe452cd898905ce5f4405fb63668cb

SHA1
1aebd4fce2cecf26d811d0b5a8e0d0fc677d2c8a

SHA256
6199eec89b9781ca4ca6dec308356a8601897c9ef713ae929bc379bb984295e5

SHA512
ef9aeede250b1dcf8c6aa2748c5c30bb8a99f7af430756e8ea69740b8f67265da5090338e443a1efc8ca59eb7930109e10e03f7268d1ce2c477140027abf4780

Download Submit
C:\Windows\system\TpWdEvW.exe

Filesize
1.2MB

MD5
5790dd133b4e1169ba1cf2f5f7ab19cb

SHA1
91d9957283d20922b967b7e107c700cd4d100f8b

SHA256
643199812bf245c0c93b0a2a761ecc92bdacf22080454f776f11755ff34feea1

SHA512
6f621e01a7e92b71092deb6f823bcc5257fa5b182e627f364e5900a36879c332832c8c3497fe805209ffeccca62c695ffeb830035303a0afd22ac9763260aadc

Download Submit
C:\Windows\system\UBUUvTn.exe

Filesize
1.2MB

MD5
f2ef94ea6c4c8709d7596030e828d03e

SHA1
2da879170c102b965f11ba3ce4105922656041a3

SHA256
9377d8d8ceaa84284e6e4b30876467db9c4c136de9a2b6a80df0a999697a488d

SHA512
fa2d2252d096f16ec522a9d868bf216675dad945c33a6fac92f2e83b3b1904bc2af256dd9f3ce506a47abd468c52f9e674f4e1dedff6b2e77db22d58e2c9e3ef

Download Submit
C:\Windows\system\YBrzsvX.exe

Filesize
1.2MB

MD5
9c739d35dcf7b8bb765670b27cebf42a

SHA1
a24164b47f3c37b3580b1428e4f8b9b30c2b3cbf

SHA256
86d435ec50235242535d3262dd24346cdfd5d33000e36ed97962bb37b6bcde87

SHA512
1972b499e7bc1e6e4fdb61901b82ead78dd89e7c7e9763cc5684334bb5445ea33cf35d29ec613eff112997358633ee37b601de261293194682dacdfb8fae6d35

Download Submit
C:\Windows\system\YvKDWLl.exe

Filesize
1.2MB

MD5
4c123a643ed3c7f2ca4dc08fb97519be

SHA1
51674f2e0ad0878e958c23dc60b094dd7a581c5a

SHA256
e33923118a1cb41b85c81ca26f0ed489845e691c64bc8eff63dcabe19909848a

SHA512
29b23a6e148cf6951a084dadc870a57af45fd2c4401aa2ab757f609185093684069ca9b568c2c1170ba97aa0b7f6a6504e309a80a07503d056bd1542a10cf9c8

Download Submit
C:\Windows\system\aCNLYVc.exe

Filesize
1.2MB

MD5
07811bec440c921c8c002c96fcbf46a5

SHA1
9ad8e7649eb9fc4e88d3540b670dd70f0a4d07ad

SHA256
87ba06159ae3b7b9eaa40757fd6922250e1aab93f08f7f086b417bc02331c8b1

SHA512
2c6f5b6cb539aa591297319d3ec4c8b432164b59bbf22e79dea5ace1192ab841ec56c0be184f87af8e232f31722ea29b7df8ecf8322f2a5cd07fadaafaf2e565

Download Submit
C:\Windows\system\buoGfno.exe

Filesize
1.2MB

MD5
fddc59718bfe38333b1f34d69ecdef0c

SHA1
017883c164521b10cbdc2090258a9650e6e6b271

SHA256
f19826996fbc63bba68277ad529d6396c068b55d43e517ad0b6413cf40cd6a0f

SHA512
b3816dc49ff73c24a12894f15efc55e5b09aa04d94f02d3ccb3e0faf09aa74ca67996b26085075b0f3417925f7fe9bdfe819c45a2cef448f8991a6361ea0c0b2

Download Submit
C:\Windows\system\cIhjbyC.exe

Filesize
1.2MB

MD5
5bb08d02074f0581f0ad2fe50c32bc14

SHA1
ffd5fa7292b3fab82beb354ce2eca051dc3e4af3

SHA256
c54a1c9da72a30691eb1e5acd687e16b4498200a68284fa6842ebfae2339a141

SHA512
cb18946ef0e9793ad0c58c9e6526085e32d49142e521415d590076ffce5700a17ef3dc0f16ba91507afa4a8de80a5f17c8743543ee9611295ccacadcc3a399a2

Download Submit
C:\Windows\system\dCxjvAZ.exe

Filesize
1.2MB

MD5
39003db0c267dc8d92209cfef667940b

SHA1
322d74135aa4ec037cb9ec635f484a4ef17601c3

SHA256
a78526be23796c1bccdc22d6e9e3525bb9e481e13d6030101c7dc4ee97ba7c13

SHA512
2f9611800d656aa0c7613c62988059cc71b98d16e9e673a4e5ebbbb588d89b6973826dfab8e823ea5197e00ff1af67ed4fc1c205bc0d20576875865fc2b77096

Download Submit
C:\Windows\system\gIRUHKT.exe

Filesize
1.2MB

MD5
37b93410e0ae77da89ed6eb611e6b30c

SHA1
1ae9a9a9a972a6c0d3a4fe23fdc6d2a9a181d838

SHA256
c4a5b57b668d13c81be1c593c67d957287f9dd6578c67fbb5364367930f32a08

SHA512
cdd29f3ce7c9cb5028d23af57e683863ca98cbcced7d3d1055c9306719425316258277ed8efed6407f077dfbfc067314bf707974b57000f6aa8328cb5d5cc46e

Download Submit
C:\Windows\system\hBYCOEy.exe

Filesize
1.2MB

MD5
f53e0d2c1a441c6ca385a2b159f18fba

SHA1
da3824aa21a8595fd2bdad86cd1dddb8b271e982

SHA256
f9838ba02ed48892ccfe1aecbdcc86e2fde4fd5f811b165ab81c2dadf30ea0fd

SHA512
355b12ab54ab6e08e1c6b46e6b0208ea18125e060b20503ba1898ec9edf620aae803bd86f75bfe16467719ae9bac0185e0e73f73295d752586cdb9a093a97e1f

Download Submit
C:\Windows\system\mQISVRa.exe

Filesize
1.2MB

MD5
2023318431ceeffd50ebdd7b8ae2754f

SHA1
65e80ed1a06b29540bb571057632571c47a2223e

SHA256
78f2a60aec14ab3d091092f0c0846788087ad7686cd179a41682b9c26338e6d6

SHA512
8bcb4d245090d7a48700d3d2881c4fa335eb7f2683cdf86930db4c23da3f1e55f61e2304436f77b47a33036161d19de2b3ccf9738b8a4ab4b7325f84efaedc6b

Download Submit
C:\Windows\system\mtrplGk.exe

Filesize
1.2MB

MD5
df22ea80e0ad4d9eb9a6e839e5eb0553

SHA1
e487bc17e8e5ad04dfd0bc7cc937e2fcce731f76

SHA256
939626b468a5d6b56dc6e6c61d77a0c9b5c5df6a1e682b57278e7b1d8400a3e0

SHA512
3d4e39ead800ed85c9ca3f036df22c8900bc96a30359a83a9ec7d4ece4ddeede48f85ad3d952fe10ba64bd17b151ec969a00d99029f8eda3e05cbc83fb80f831

Download Submit
C:\Windows\system\pXIeNUd.exe

Filesize
1.2MB

MD5
e740601f0ccc5ad74baa54b8e8c62486

SHA1
4382bc3e3808b4353acbd887e275b52d539e2335

SHA256
87b0a159371a58ff53ece708857a164946c1752efcdda21f6a9dd7b47378c15b

SHA512
2a2a9f71781f7efb774dea066bbe84048d077b263de71ba718ff6ff1a3cf2eb45961a8e59f51794ab06b6afd176418f022e395f4109a61b561a30276d81a4e64

Download Submit
C:\Windows\system\qqXuihi.exe

Filesize
1.2MB

MD5
9c638dc2436af962934360e23a81fbcd

SHA1
692ab3bcbe8084d71548ae0c4b0095274e09452a

SHA256
1ad8ed7712730f9ad1c07a6383b4771382bbea2e078163b8a31121194115161e

SHA512
50d40e849d0bf807eb9dbd113774776015ee00acc3e0d93b8981e54d819eb5f475b2bee15c869258fd8bc07a1138d09b93b0e2beb16ba7ed635bafe3139115d2

Download Submit
C:\Windows\system\sEjXcwe.exe

Filesize
1.2MB

MD5
a02f61b8cbc441cdb4ad0185ad016af0

SHA1
a3c9bdad6e265e89ab5bdd5a447e2ee4d0b57ac0

SHA256
bc20367c63f47f76623502e7e66cda07abb2711d7a358c61883506aea4da102f

SHA512
e5852276bcece4fe0ba42ee2cd9aad7c9e12eb8643ad1c3016b9733882c2754d5f9e8f3cbbaa687c905b394a1c7a1c8ef8ea3508517522f81aa7c29089670f43

Download Submit
C:\Windows\system\xTbcsrS.exe

Filesize
1.2MB

MD5
35f9ef38d6e4773aedb5e9476268fd7c

SHA1
7137b1cb6dc51ab4f8f4229f2d15d9ca73841819

SHA256
efebe10170078317376615b13104796ba8c2c8d5c8ed0b498b912e190bc336db

SHA512
4b9751981369542faed74b4c55dc6ae2a6dbf0c72d712604a50f68b9e31ce273619e278577b3dbbc4709da1c1679b243a6a59143ceb8ac857c7adff0b5b43fbc

Download Submit
C:\Windows\system\xUUMotP.exe

Filesize
1.2MB

MD5
d6dc6a19a0cc4c87d26013deb3680ade

SHA1
c2b7e5e27753b5ce5aeef67f14063202a90524d0

SHA256
4d265b841dd3a16f922de01dac98f72ccb8f99d6dcf0d034995cc0e598c56cb6

SHA512
2df561fc2ad68517393336d096d563f9b5c14edb15900478ffc5ef8f7d2c760468e924dbcfeb186a7d27c1a9bd7947f2e8c4ee354485f9d7855fb11dd4d31d98

Download Submit
C:\Windows\system\zMewUPs.exe

Filesize
1.2MB

MD5
70d2f2d54b8ed7cf466f7a69381dc2b1

SHA1
103d19363019b72e51dfaa8adf8102ab0ad248ba

SHA256
95a99e9457e496accfe2e8331c910a22ea96980c359c96a4ed7c7fc50df1391b

SHA512
9f3f1d36cfa3f02c1e5dc361627718916f0839bcd2c9a6bc13e35a615120b0ad8dae3a054af15c64846e33aa6b2104022ab2f1f59c592845b4196f16aa7beb72

Download Submit
C:\Windows\system\zNlrMSo.exe

Filesize
1.2MB

MD5
434d74b645324a9ef6a3716ffce393eb

SHA1
fefde664a3c10f50c363047cd53a7a6b0c3a06b1

SHA256
3eddaaa2df49517588eb893cab9eed2c2100c7a7345b1d2edcd9ee3d23648a6e

SHA512
e88bd1b23e7b86d1fbd080ca93e0c46d1eda7bde56f53fdb1848a52b222d0e144094ba70e159833ab301e6081766b93bab958c432636ccf17bb65fc42018ac4f

Download Submit
\Windows\system\rtTqLQT.exe

Filesize
1.2MB

MD5
c72515e0f7aff08b11bf92135b7bf4a4

SHA1
9e0fe3835332a0643248893f88f4b1a7080a075f

SHA256
c542698a91143531431a3a60a8db750ae99313ec0089ea095cd6dafab51f8396

SHA512
c11d0d7ee75988331a22010365c97939badd7a615162fee9131957deebc61912bfe59ff9ba3451cdbe550f40b9cdaf921479e7011d210d3c8984fd3226a50a4d

Download Submit
\Windows\system\sjFkTNj.exe

Filesize
1.2MB

MD5
944ef30989960d978ff785ae9c6a771e

SHA1
7ff0620d561098e70b2cc8f497e76bcb57752006

SHA256
317c31fe8b08f9ae7a0a1fe090e88c098a4696ec566ea246cc45f5247068c4e3

SHA512
ddbed9ecc395681e1cca805098f9502f59198e548188cac0728e288a3d6d9b826f0f467048be49e03e60472481985f4214666b543e646809ce2ae15073f8cb9b

Download Submit
\Windows\system\yBYdlIO.exe

Filesize
1.2MB

MD5
5296b8ee696738ce7680304193b89885

SHA1
5d34808872fab6f4b630755ee95d2d0c03fc6683

SHA256
6fdcf75433b70487802b7db9a12c6a1ab74ae2d14640c66afef37bc32ce4eba6

SHA512
05a383ea98dfa8e7a8e85a9ad634d5f7f1adcdb256bb4e35aac19ac6ed6de31f040def0fbbbb9237ca4de4068f1976d0c853f53b2a07155a5c461f1d5ba40200

Download Submit
memory/2076-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download